Security

Latest Dynatrace
Reference
Published Jul 16, 2026

Contains entity definitions for Azure Security stored in Smartscape on Grail. Entities are prefixed with AZURE_.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for Azure Security entity types.

smartscapeNodes "AZURE_MICROSOFT_ATTESTATION*"
| append [ smartscapeNodes "AZURE_MICROSOFT_CODESIGNING*" ]
| append [ smartscapeNodes "AZURE_MICROSOFT_CONFIDENTIALLEDGER*" ]
| append [ smartscapeNodes "AZURE_MICROSOFT_DATAPROTECTION*" ]
| append [ smartscapeNodes "AZURE_MICROSOFT_EASM*" ]
| append [ smartscapeNodes "AZURE_MICROSOFT_HARDWARESECURITYMODULES*" ]
| append [ smartscapeNodes "AZURE_MICROSOFT_KEYVAULT*" ]
| append [ smartscapeNodes "AZURE_MICROSOFT_M365SECURITYANDCOMPLIANCE*" ]
| append [ smartscapeNodes "AZURE_MICROSOFT_SECRETSYNCCONTROLLER*" ]
| append [ smartscapeNodes "AZURE_MICROSOFT_SECURITY*" ]
| append [ smartscapeNodes "AZURE_MICROSOFT_SECURITYANDCOMPLIANCE*" ]
| append [ smartscapeNodes "AZURE_MICROSOFT_SECURITYINSIGHTS*" ]
| append [ smartscapeNodes "AZURE_MICROSOFT_WINDOWSESU*" ]

Permission fields

azure.subscription
azure.resource.group
dt.security_context

API collections

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITY_APICOLLECTIONS

API collections in Microsoft Defender for Cloud.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITY_APICOLLECTIONS"

smartscapeNodes "AZURE_MICROSOFT_SECURITY_APICOLLECTIONS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Advanced threat protection settings

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITY_ADVANCEDTHREATPROTECTIONSETTINGS

Advanced threat protection settings in Microsoft Defender for Cloud.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITY_ADVANCEDTHREATPROTECTIONSETTINGS"

smartscapeNodes "AZURE_MICROSOFT_SECURITY_ADVANCEDTHREATPROTECTIONSETTINGS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Aggregations

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITYINSIGHTS_AGGREGATIONS

Aggregations in Microsoft Sentinel.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITYINSIGHTS_AGGREGATIONS"

smartscapeNodes "AZURE_MICROSOFT_SECURITYINSIGHTS_AGGREGATIONS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Alert rule templates

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITYINSIGHTS_ALERTRULETEMPLATES

Alert rule templates in Microsoft Sentinel.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITYINSIGHTS_ALERTRULETEMPLATES"

smartscapeNodes "AZURE_MICROSOFT_SECURITYINSIGHTS_ALERTRULETEMPLATES"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Alerts suppression rules

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITY_ALERTSSUPPRESSIONRULES

Alerts suppression rules in Microsoft Defender for Cloud.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITY_ALERTSSUPPRESSIONRULES"

smartscapeNodes "AZURE_MICROSOFT_SECURITY_ALERTSSUPPRESSIONRULES"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Applications

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITY_APPLICATIONS

Applications in Microsoft Defender for Cloud.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITY_APPLICATIONS"

smartscapeNodes "AZURE_MICROSOFT_SECURITY_APPLICATIONS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Assessment metadata

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITY_ASSESSMENTMETADATA

Assessment metadata in Microsoft Defender for Cloud.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITY_ASSESSMENTMETADATA"

smartscapeNodes "AZURE_MICROSOFT_SECURITY_ASSESSMENTMETADATA"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Assignments

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITY_ASSIGNMENTS

Assignments in Microsoft Defender for Cloud.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITY_ASSIGNMENTS"

smartscapeNodes "AZURE_MICROSOFT_SECURITY_ASSIGNMENTS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Attestation provider

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_ATTESTATION_ATTESTATIONPROVIDERS

Azure Attestation service provider for verifying trustworthiness of platform components.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_ATTESTATION_ATTESTATIONPROVIDERS"

smartscapeNodes "AZURE_MICROSOFT_ATTESTATION_ATTESTATIONPROVIDERS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Auto provisioning settings

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITY_AUTOPROVISIONINGSETTINGS

Auto provisioning settings in Microsoft Defender for Cloud.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITY_AUTOPROVISIONINGSETTINGS"

smartscapeNodes "AZURE_MICROSOFT_SECURITY_AUTOPROVISIONINGSETTINGS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Automations

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITY_AUTOMATIONS

Automations in Microsoft Defender for Cloud.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITY_AUTOMATIONS"

smartscapeNodes "AZURE_MICROSOFT_SECURITY_AUTOMATIONS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Azure key vault secret provider classes

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECRETSYNCCONTROLLER_AZUREKEYVAULTSECRETPROVIDERCLASSES

Azure key vault secret provider classes in Azure Secret Sync Controller.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECRETSYNCCONTROLLER_AZUREKEYVAULTSECRETPROVIDERCLASSES"

smartscapeNodes "AZURE_MICROSOFT_SECRETSYNCCONTROLLER_AZUREKEYVAULTSECRETPROVIDERCLASSES"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Backup instance

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_DATAPROTECTION_BACKUPVAULTS_BACKUPINSTANCES

Individual protected workload instance in an Azure Backup vault.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_DATAPROTECTION_BACKUPVAULTS_BACKUPINSTANCES"

smartscapeNodes "AZURE_MICROSOFT_DATAPROTECTION_BACKUPVAULTS_BACKUPINSTANCES"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Backup job

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_DATAPROTECTION_BACKUPVAULTS_BACKUPJOBS

Backup or restore job execution record in an Azure Backup vault.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_DATAPROTECTION_BACKUPVAULTS_BACKUPJOBS"

smartscapeNodes "AZURE_MICROSOFT_DATAPROTECTION_BACKUPVAULTS_BACKUPJOBS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Backup policy

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_DATAPROTECTION_BACKUPVAULTS_BACKUPPOLICIES

Backup policy defining schedule and retention rules for a Backup vault.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_DATAPROTECTION_BACKUPVAULTS_BACKUPPOLICIES"

smartscapeNodes "AZURE_MICROSOFT_DATAPROTECTION_BACKUPVAULTS_BACKUPPOLICIES"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Backup vault

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_DATAPROTECTION_BACKUPVAULTS

Azure Backup vault storing backup data for supported workloads.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_DATAPROTECTION_BACKUPVAULTS"

smartscapeNodes "AZURE_MICROSOFT_DATAPROTECTION_BACKUPVAULTS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Billing statistics

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITYINSIGHTS_BILLINGSTATISTICS

Billing statistics in Microsoft Sentinel.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITYINSIGHTS_BILLINGSTATISTICS"

smartscapeNodes "AZURE_MICROSOFT_SECURITYINSIGHTS_BILLINGSTATISTICS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Bookmarks

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITYINSIGHTS_BOOKMARKS

Bookmarks in Microsoft Sentinel.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITYINSIGHTS_BOOKMARKS"

smartscapeNodes "AZURE_MICROSOFT_SECURITYINSIGHTS_BOOKMARKS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Cases

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITYINSIGHTS_CASES

Cases in Microsoft Sentinel.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITYINSIGHTS_CASES"

smartscapeNodes "AZURE_MICROSOFT_SECURITYINSIGHTS_CASES"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Cloud HSM clusters

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_HARDWARESECURITYMODULES_CLOUDHSMCLUSTERS

Cloud HSM clusters in Azure Dedicated HSM.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_HARDWARESECURITYMODULES_CLOUDHSMCLUSTERS"

smartscapeNodes "AZURE_MICROSOFT_HARDWARESECURITYMODULES_CLOUDHSMCLUSTERS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Compliance results

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITY_COMPLIANCERESULTS

Compliance results in Microsoft Defender for Cloud.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITY_COMPLIANCERESULTS"

smartscapeNodes "AZURE_MICROSOFT_SECURITY_COMPLIANCERESULTS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Compliances

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITY_COMPLIANCES

Compliances in Microsoft Defender for Cloud.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITY_COMPLIANCES"

smartscapeNodes "AZURE_MICROSOFT_SECURITY_COMPLIANCES"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Content packages

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITYINSIGHTS_CONTENTPACKAGES

Content packages in Microsoft Sentinel.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITYINSIGHTS_CONTENTPACKAGES"

smartscapeNodes "AZURE_MICROSOFT_SECURITYINSIGHTS_CONTENTPACKAGES"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Content product packages

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITYINSIGHTS_CONTENTPRODUCTPACKAGES

Content product packages in Microsoft Sentinel.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITYINSIGHTS_CONTENTPRODUCTPACKAGES"

smartscapeNodes "AZURE_MICROSOFT_SECURITYINSIGHTS_CONTENTPRODUCTPACKAGES"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Content product templates

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITYINSIGHTS_CONTENTPRODUCTTEMPLATES

Content product templates in Microsoft Sentinel.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITYINSIGHTS_CONTENTPRODUCTTEMPLATES"

smartscapeNodes "AZURE_MICROSOFT_SECURITYINSIGHTS_CONTENTPRODUCTTEMPLATES"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Content templates

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITYINSIGHTS_CONTENTTEMPLATES

Content templates in Microsoft Sentinel.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITYINSIGHTS_CONTENTTEMPLATES"

smartscapeNodes "AZURE_MICROSOFT_SECURITYINSIGHTS_CONTENTTEMPLATES"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Custom recommendations

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITY_CUSTOMRECOMMENDATIONS

Custom recommendations in Microsoft Defender for Cloud.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITY_CUSTOMRECOMMENDATIONS"

smartscapeNodes "AZURE_MICROSOFT_SECURITY_CUSTOMRECOMMENDATIONS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Data connector definitions

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITYINSIGHTS_DATACONNECTORDEFINITIONS

Data connector definitions in Microsoft Sentinel.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITYINSIGHTS_DATACONNECTORDEFINITIONS"

smartscapeNodes "AZURE_MICROSOFT_SECURITYINSIGHTS_DATACONNECTORDEFINITIONS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Data connectors

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITYINSIGHTS_DATACONNECTORS

Data connectors in Microsoft Sentinel.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITYINSIGHTS_DATACONNECTORS"

smartscapeNodes "AZURE_MICROSOFT_SECURITYINSIGHTS_DATACONNECTORS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Dedicated HSMs

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_HARDWARESECURITYMODULES_DEDICATEDHSMS

Dedicated HSMs in Azure Dedicated HSM.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_HARDWARESECURITYMODULES_DEDICATEDHSMS"

smartscapeNodes "AZURE_MICROSOFT_HARDWARESECURITYMODULES_DEDICATEDHSMS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Defender EASM workspaces

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_EASM_WORKSPACES

Defender EASM workspaces in Microsoft Defender External Attack Surface Management.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_EASM_WORKSPACES"

smartscapeNodes "AZURE_MICROSOFT_EASM_WORKSPACES"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Defender for cloud assessment

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITY_ASSESSMENTS

Security assessment recommendation from Microsoft Defender for Cloud.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITY_ASSESSMENTS"

smartscapeNodes "AZURE_MICROSOFT_SECURITY_ASSESSMENTS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Defender for cloud plan

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITY_PRICINGS

Microsoft Defender for Cloud pricing plan for a resource type.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITY_PRICINGS"

smartscapeNodes "AZURE_MICROSOFT_SECURITY_PRICINGS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Defender for storage settings

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITY_DEFENDERFORSTORAGESETTINGS

Defender for storage settings in Microsoft Defender for Cloud.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITY_DEFENDERFORSTORAGESETTINGS"

smartscapeNodes "AZURE_MICROSOFT_SECURITY_DEFENDERFORSTORAGESETTINGS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Deleted backup instances

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_DATAPROTECTION_BACKUPVAULTS_DELETEDBACKUPINSTANCES

Deleted backup instances within Backup Vaults in Azure Backup (Data Protection).

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_DATAPROTECTION_BACKUPVAULTS_DELETEDBACKUPINSTANCES"

smartscapeNodes "AZURE_MICROSOFT_DATAPROTECTION_BACKUPVAULTS_DELETEDBACKUPINSTANCES"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Device security groups

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITY_DEVICESECURITYGROUPS

Device security groups in Microsoft Defender for Cloud.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITY_DEVICESECURITYGROUPS"

smartscapeNodes "AZURE_MICROSOFT_SECURITY_DEVICESECURITYGROUPS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Entities

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITYINSIGHTS_ENTITIES

Entities in Microsoft Sentinel.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITYINSIGHTS_ENTITIES"

smartscapeNodes "AZURE_MICROSOFT_SECURITYINSIGHTS_ENTITIES"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Entity queries

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITYINSIGHTS_ENTITYQUERIES

Entity queries in Microsoft Sentinel.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITYINSIGHTS_ENTITYQUERIES"

smartscapeNodes "AZURE_MICROSOFT_SECURITYINSIGHTS_ENTITYQUERIES"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Entity query templates

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITYINSIGHTS_ENTITYQUERYTEMPLATES

Entity query templates in Microsoft Sentinel.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITYINSIGHTS_ENTITYQUERYTEMPLATES"

smartscapeNodes "AZURE_MICROSOFT_SECURITYINSIGHTS_ENTITYQUERYTEMPLATES"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

File imports

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITYINSIGHTS_FILEIMPORTS

File imports in Microsoft Sentinel.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITYINSIGHTS_FILEIMPORTS"

smartscapeNodes "AZURE_MICROSOFT_SECURITYINSIGHTS_FILEIMPORTS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Governance rules

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITY_GOVERNANCERULES

Governance rules in Microsoft Defender for Cloud.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITY_GOVERNANCERULES"

smartscapeNodes "AZURE_MICROSOFT_SECURITY_GOVERNANCERULES"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Health reports

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITY_HEALTHREPORTS

Health reports in Microsoft Defender for Cloud.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITY_HEALTHREPORTS"

smartscapeNodes "AZURE_MICROSOFT_SECURITY_HEALTHREPORTS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Hunts

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITYINSIGHTS_HUNTS

Hunts in Microsoft Sentinel.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITYINSIGHTS_HUNTS"

smartscapeNodes "AZURE_MICROSOFT_SECURITYINSIGHTS_HUNTS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

IOT security solutions

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITY_IOTSECURITYSOLUTIONS

IOT security solutions in Microsoft Defender for Cloud.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITY_IOTSECURITYSOLUTIONS"

smartscapeNodes "AZURE_MICROSOFT_SECURITY_IOTSECURITYSOLUTIONS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Information protection policies

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITY_INFORMATIONPROTECTIONPOLICIES

Information protection policies in Microsoft Defender for Cloud.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITY_INFORMATIONPROTECTIONPOLICIES"

smartscapeNodes "AZURE_MICROSOFT_SECURITY_INFORMATIONPROTECTIONPOLICIES"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Key vault

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_KEYVAULT_VAULTS

Azure Key Vault for secrets, keys, and certificate management.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_KEYVAULT_VAULTS"

smartscapeNodes "AZURE_MICROSOFT_KEYVAULT_VAULTS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Ledgers

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_CONFIDENTIALLEDGER_LEDGERS

Ledgers in Azure Confidential Ledger.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_CONFIDENTIALLEDGER_LEDGERS"

smartscapeNodes "AZURE_MICROSOFT_CONFIDENTIALLEDGER_LEDGERS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

MDE onboardings

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITY_MDEONBOARDINGS

MDE onboardings in Microsoft Defender for Cloud.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITY_MDEONBOARDINGS"

smartscapeNodes "AZURE_MICROSOFT_SECURITY_MDEONBOARDINGS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Managed HSM

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_KEYVAULT_MANAGEDHSMS

Azure Key Vault Managed HSM.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_KEYVAULT_MANAGEDHSMS"

smartscapeNodes "AZURE_MICROSOFT_KEYVAULT_MANAGEDHSMS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Managed ccfs

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_CONFIDENTIALLEDGER_MANAGEDCCFS

Managed ccfs in Azure Confidential Ledger.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_CONFIDENTIALLEDGER_MANAGEDCCFS"

smartscapeNodes "AZURE_MICROSOFT_CONFIDENTIALLEDGER_MANAGEDCCFS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Metadata

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITYINSIGHTS_METADATA

Metadata in Microsoft Sentinel.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITYINSIGHTS_METADATA"

smartscapeNodes "AZURE_MICROSOFT_SECURITYINSIGHTS_METADATA"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Microsoft Sentinel alert rule

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITYINSIGHTS_ALERTRULES

Analytic rule detecting threats in Microsoft Sentinel.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITYINSIGHTS_ALERTRULES"

smartscapeNodes "AZURE_MICROSOFT_SECURITYINSIGHTS_ALERTRULES"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Microsoft Sentinel automation rule

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITYINSIGHTS_AUTOMATIONRULES

Automation rule for orchestrating incident response in Microsoft Sentinel.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITYINSIGHTS_AUTOMATIONRULES"

smartscapeNodes "AZURE_MICROSOFT_SECURITYINSIGHTS_AUTOMATIONRULES"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Microsoft Sentinel incident

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITYINSIGHTS_INCIDENTS

Security incident aggregated from Sentinel alerts.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITYINSIGHTS_INCIDENTS"

smartscapeNodes "AZURE_MICROSOFT_SECURITYINSIGHTS_INCIDENTS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Multiple activation keys

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_WINDOWSESU_MULTIPLEACTIVATIONKEYS

Multiple activation keys in Azure Extended Security Updates.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_WINDOWSESU_MULTIPLEACTIVATIONKEYS"

smartscapeNodes "AZURE_MICROSOFT_WINDOWSESU_MULTIPLEACTIVATIONKEYS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Office consents

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITYINSIGHTS_OFFICECONSENTS

Office consents in Microsoft Sentinel.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITYINSIGHTS_OFFICECONSENTS"

smartscapeNodes "AZURE_MICROSOFT_SECURITYINSIGHTS_OFFICECONSENTS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

On boarding states

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITYINSIGHTS_ONBOARDINGSTATES

On boarding states in Microsoft Sentinel.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITYINSIGHTS_ONBOARDINGSTATES"

smartscapeNodes "AZURE_MICROSOFT_SECURITYINSIGHTS_ONBOARDINGSTATES"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Private link services for EDM upload

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITYANDCOMPLIANCE_PRIVATELINKSERVICESFOREDMUPLOAD

Private link services for EDM upload in Microsoft 365 Compliance.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITYANDCOMPLIANCE_PRIVATELINKSERVICESFOREDMUPLOAD"

smartscapeNodes "AZURE_MICROSOFT_SECURITYANDCOMPLIANCE_PRIVATELINKSERVICESFOREDMUPLOAD"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Private link services for IP policy sync

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_M365SECURITYANDCOMPLIANCE_PRIVATELINKSERVICESFORMIPPOLICYSYNC

Private link services for IP policy sync in Microsoft 365 Security and Compliance.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_M365SECURITYANDCOMPLIANCE_PRIVATELINKSERVICESFORMIPPOLICYSYNC"

smartscapeNodes "AZURE_MICROSOFT_M365SECURITYANDCOMPLIANCE_PRIVATELINKSERVICESFORMIPPOLICYSYNC"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Private link services for M365 compliance center

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITYANDCOMPLIANCE_PRIVATELINKSERVICESFORM365COMPLIANCECENTER

Private link services for M365 compliance center in Microsoft 365 Compliance.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITYANDCOMPLIANCE_PRIVATELINKSERVICESFORM365COMPLIANCECENTER"

smartscapeNodes "AZURE_MICROSOFT_SECURITYANDCOMPLIANCE_PRIVATELINKSERVICESFORM365COMPLIANCECENTER"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Private link services for M365 security center

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITYANDCOMPLIANCE_PRIVATELINKSERVICESFORM365SECURITYCENTER

Private link services for M365 security center in Microsoft 365 Compliance.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITYANDCOMPLIANCE_PRIVATELINKSERVICESFORM365SECURITYCENTER"

smartscapeNodes "AZURE_MICROSOFT_SECURITYANDCOMPLIANCE_PRIVATELINKSERVICESFORM365SECURITYCENTER"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Private link services for MIP policy sync

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITYANDCOMPLIANCE_PRIVATELINKSERVICESFORMIPPOLICYSYNC

Private link services for MIP policy sync in Microsoft 365 Compliance.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITYANDCOMPLIANCE_PRIVATELINKSERVICESFORMIPPOLICYSYNC"

smartscapeNodes "AZURE_MICROSOFT_SECURITYANDCOMPLIANCE_PRIVATELINKSERVICESFORMIPPOLICYSYNC"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Private link services for O365 management activity API

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITYANDCOMPLIANCE_PRIVATELINKSERVICESFORO365MANAGEMENTACTIVITYAPI

Private link services for O365 management activity API in Microsoft 365 Compliance.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITYANDCOMPLIANCE_PRIVATELINKSERVICESFORO365MANAGEMENTACTIVITYAPI"

smartscapeNodes "AZURE_MICROSOFT_SECURITYANDCOMPLIANCE_PRIVATELINKSERVICESFORO365MANAGEMENTACTIVITYAPI"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Private link services for SCC PowerShell

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITYANDCOMPLIANCE_PRIVATELINKSERVICESFORSCCPOWERSHELL

Private link services for SCC PowerShell in Microsoft 365 Compliance.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITYANDCOMPLIANCE_PRIVATELINKSERVICESFORSCCPOWERSHELL"

smartscapeNodes "AZURE_MICROSOFT_SECURITYANDCOMPLIANCE_PRIVATELINKSERVICESFORSCCPOWERSHELL"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Private links

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITY_PRIVATELINKS

Private links in Microsoft Defender for Cloud.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITY_PRIVATELINKS"

smartscapeNodes "AZURE_MICROSOFT_SECURITY_PRIVATELINKS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Recommendations

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITYINSIGHTS_RECOMMENDATIONS

Recommendations in Microsoft Sentinel.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITYINSIGHTS_RECOMMENDATIONS"

smartscapeNodes "AZURE_MICROSOFT_SECURITYINSIGHTS_RECOMMENDATIONS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Regulatory compliance standards

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITY_REGULATORYCOMPLIANCESTANDARDS

Regulatory compliance standards in Microsoft Defender for Cloud.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITY_REGULATORYCOMPLIANCESTANDARDS"

smartscapeNodes "AZURE_MICROSOFT_SECURITY_REGULATORYCOMPLIANCESTANDARDS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Resource guards

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_DATAPROTECTION_RESOURCEGUARDS

Resource guards in Azure Backup.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_DATAPROTECTION_RESOURCEGUARDS"

smartscapeNodes "AZURE_MICROSOFT_DATAPROTECTION_RESOURCEGUARDS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

SQL vulnerability assessments

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITY_SQLVULNERABILITYASSESSMENTS

SQL vulnerability assessments in Microsoft Defender for Cloud.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITY_SQLVULNERABILITYASSESSMENTS"

smartscapeNodes "AZURE_MICROSOFT_SECURITY_SQLVULNERABILITYASSESSMENTS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Secret syncs

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECRETSYNCCONTROLLER_SECRETSYNCS

Secret syncs in Azure Secret Sync Controller.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECRETSYNCCONTROLLER_SECRETSYNCS"

smartscapeNodes "AZURE_MICROSOFT_SECRETSYNCCONTROLLER_SECRETSYNCS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Secure scores

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITY_SECURESCORES

Secure scores in Microsoft Defender for Cloud.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITY_SECURESCORES"

smartscapeNodes "AZURE_MICROSOFT_SECURITY_SECURESCORES"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Security ML analytics settings

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITYINSIGHTS_SECURITYMLANALYTICSSETTINGS

Security ML analytics settings in Microsoft Sentinel.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITYINSIGHTS_SECURITYMLANALYTICSSETTINGS"

smartscapeNodes "AZURE_MICROSOFT_SECURITYINSIGHTS_SECURITYMLANALYTICSSETTINGS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Security connectors

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITY_SECURITYCONNECTORS

Security connectors in Microsoft Defender for Cloud.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITY_SECURITYCONNECTORS"

smartscapeNodes "AZURE_MICROSOFT_SECURITY_SECURITYCONNECTORS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Security contacts

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITY_SECURITYCONTACTS

Security contacts in Microsoft Defender for Cloud.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITY_SECURITYCONTACTS"

smartscapeNodes "AZURE_MICROSOFT_SECURITY_SECURITYCONTACTS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Security standards

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITY_SECURITYSTANDARDS

Security standards in Microsoft Defender for Cloud.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITY_SECURITYSTANDARDS"

smartscapeNodes "AZURE_MICROSOFT_SECURITY_SECURITYSTANDARDS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Sensitivity settings

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITY_SENSITIVITYSETTINGS

Sensitivity settings in Microsoft Defender for Cloud.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITY_SENSITIVITYSETTINGS"

smartscapeNodes "AZURE_MICROSOFT_SECURITY_SENSITIVITYSETTINGS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Server vulnerability assessments

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITY_SERVERVULNERABILITYASSESSMENTS

Server vulnerability assessments in Microsoft Defender for Cloud.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITY_SERVERVULNERABILITYASSESSMENTS"

smartscapeNodes "AZURE_MICROSOFT_SECURITY_SERVERVULNERABILITYASSESSMENTS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Server vulnerability assessments settings

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITY_SERVERVULNERABILITYASSESSMENTSSETTINGS

Server vulnerability assessments settings in Microsoft Defender for Cloud.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITY_SERVERVULNERABILITYASSESSMENTSSETTINGS"

smartscapeNodes "AZURE_MICROSOFT_SECURITY_SERVERVULNERABILITYASSESSMENTSSETTINGS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Settings

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITYINSIGHTS_SETTINGS

Settings in Microsoft Sentinel.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITYINSIGHTS_SETTINGS"

smartscapeNodes "AZURE_MICROSOFT_SECURITYINSIGHTS_SETTINGS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Software inventories

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITY_SOFTWAREINVENTORIES

Software inventories in Microsoft Defender for Cloud.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITY_SOFTWAREINVENTORIES"

smartscapeNodes "AZURE_MICROSOFT_SECURITY_SOFTWAREINVENTORIES"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Source controls

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITYINSIGHTS_SOURCECONTROLS

Source controls in Microsoft Sentinel.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITYINSIGHTS_SOURCECONTROLS"

smartscapeNodes "AZURE_MICROSOFT_SECURITYINSIGHTS_SOURCECONTROLS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Standard assignments

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITY_STANDARDASSIGNMENTS

Standard assignments in Microsoft Defender for Cloud.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITY_STANDARDASSIGNMENTS"

smartscapeNodes "AZURE_MICROSOFT_SECURITY_STANDARDASSIGNMENTS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Standards

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITY_STANDARDS

Standards in Microsoft Defender for Cloud.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITY_STANDARDS"

smartscapeNodes "AZURE_MICROSOFT_SECURITY_STANDARDS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Triggered analytics rule runs

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITYINSIGHTS_TRIGGEREDANALYTICSRULERUNS

Triggered analytics rule runs in Microsoft Sentinel.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITYINSIGHTS_TRIGGEREDANALYTICSRULERUNS"

smartscapeNodes "AZURE_MICROSOFT_SECURITYINSIGHTS_TRIGGEREDANALYTICSRULERUNS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Trusted signing accounts

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_CODESIGNING_CODESIGNINGACCOUNTS

Trusted signing accounts in Azure Trusted Signing.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_CODESIGNING_CODESIGNINGACCOUNTS"

smartscapeNodes "AZURE_MICROSOFT_CODESIGNING_CODESIGNINGACCOUNTS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Watchlists

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITYINSIGHTS_WATCHLISTS

Watchlists in Microsoft Sentinel.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITYINSIGHTS_WATCHLISTS"

smartscapeNodes "AZURE_MICROSOFT_SECURITYINSIGHTS_WATCHLISTS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Work space manager assignments

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITYINSIGHTS_WORKSPACEMANAGERASSIGNMENTS

Work space manager assignments in Microsoft Sentinel.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITYINSIGHTS_WORKSPACEMANAGERASSIGNMENTS"

smartscapeNodes "AZURE_MICROSOFT_SECURITYINSIGHTS_WORKSPACEMANAGERASSIGNMENTS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Work space manager configurations

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITYINSIGHTS_WORKSPACEMANAGERCONFIGURATIONS

Work space manager configurations in Microsoft Sentinel.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITYINSIGHTS_WORKSPACEMANAGERCONFIGURATIONS"

smartscapeNodes "AZURE_MICROSOFT_SECURITYINSIGHTS_WORKSPACEMANAGERCONFIGURATIONS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Work space manager groups

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITYINSIGHTS_WORKSPACEMANAGERGROUPS

Work space manager groups in Microsoft Sentinel.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITYINSIGHTS_WORKSPACEMANAGERGROUPS"

smartscapeNodes "AZURE_MICROSOFT_SECURITYINSIGHTS_WORKSPACEMANAGERGROUPS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Work space manager members

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITYINSIGHTS_WORKSPACEMANAGERMEMBERS

Work space manager members in Microsoft Sentinel.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITYINSIGHTS_WORKSPACEMANAGERMEMBERS"

smartscapeNodes "AZURE_MICROSOFT_SECURITYINSIGHTS_WORKSPACEMANAGERMEMBERS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`

Work space settings

Smartscape node name: azure.resource.name

Smartscape node type: AZURE_MICROSOFT_SECURITY_WORKSPACESETTINGS

Work space settings in Microsoft Defender for Cloud.

Query

Fetch all Smartscape nodes from the smartscape.nodes table and filter for the entity type "AZURE_MICROSOFT_SECURITY_WORKSPACESETTINGS"

smartscapeNodes "AZURE_MICROSOFT_SECURITY_WORKSPACESETTINGS"

ID input

The ID is calculated based on the following fields in the defined order: azure.resource.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Azure resource fields

Contains all fields that are provided by all resources running on Azure, including Azure, Core and K8s entities.

Attribute	Type	Description	Examples
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`

Azure entity fields

Contains all fields that are provided by all Azure entities.

Attribute	Type	Description	Examples
`azure.resource.kind`	string	experimental Display name: `Azure resource kind` A kind of the Azure resource	`app,linux`
`azure.resource.sku.name`	string	experimental Display name: `Azure resource SKU name` Name of the Azure resource SKU	`B_Gen5_1`
`azure.resource.sku.tier`	string	experimental Display name: `Azure resource SKU tier` Tier of the Azure resource SKU	`Basic`
`azure.resource.sku.capacity`	string	experimental Display name: `Azure resource SKU capacity` Capacity of the Azure resource SKU	`20`
`azure.status`	string	experimental Display name: `Azure status` The status of the instance	`Running`; `Stopped (deallocated)`
`azure.provisioning_state`	string	experimental Display name: `Azure provisioning state` The provisioning status of the resource	`Succeeded`; `DELETED`; `ERROR`; `INCOMPLETE`
`azure.object`	string	experimental Display name: `Azure object` The full JSON content of Azure object
`azure.properties.version`	string	experimental Display name: `Azure properties version` The json content version	`...`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`

Cloud entity fields

Fields that are provided by all Cloud workloads.

Attribute	Type	Description	Examples
`cloud.acquisition.status`	string	experimental Display name: `Cloud acquisition status` The status of Smartscape nodes data acquisition by Data Acquisition Controller: `OK` —node is consistent; `DELETED` —node was deleted in the cloud platform; `ERROR` —there was an error acquiring the node, but the node was upserted; `INCOMPLETE` —there was an error acquiring the node child resource (for example an EC2 instance with no EBS volumes due to missing permissions), but the node was upserted.	`OK`; `DELETED`; `ERROR`; `INCOMPLETE`