Microsoft Sentinel SIEM Codeless Connector Framework (RUX)

Deploy the RUX Microsoft Sentinel CCF connector to ingest Vectra telemetry without customer-managed compute.

Overview

The Vectra AI RUX connector for Microsoft Sentinel ingests Security Operations data (detection, entity, and lockdown telemetry) from the Vectra AI platform using the Microsoft Sentinel Codeless Connector Framework (CCF).

The connector is built on the Vectra AI RUX API and is intended to replace the legacy Function App–based connector. It does not require an Azure Function App, virtual machine, or customer-managed compute for ingestion. Data polling, transformation, and ingestion are handled natively by Microsoft Sentinel through CCF and Data Collection Rules (DCRs).

The solution package includes:

• Data Connector

• Parsers

• Custom Log Analytics tables

• Workbook template

• Analytics rule templates

• Playbooks / Logic Apps

Architecture

Vectra AI Platform
        │
        │ < HTTPS polling via Microsoft Sentinel CCF >
        │
Microsoft Sentinel / Log Analytics Workspace
        │
        ├── Custom Tables
        │   ├── Detections_Data_CCF_CL
        │   ├── Entities_Data_CCF_CL
        │   └── Lockdown_Data_CCF_CL
        │
        ├── Parsers
        │   ├── VectraRUXDetections
        │   ├── VectraEntities
        │   └── VectraLockdown
        │
        ├── Workbook Template
        │   └── VectraRUXSecurityDashboard
        │
        ├── Analytics Rule Templates
        │   ├── Account incident rule
        │   └── Host incident rule
        │
        └── Playbooks / Logic Apps

Connector Components

Component	Description
Data Connector	Registers and configures the Vectra RUX connector in Microsoft Sentinel
Data Collection Rules	Define ingestion streams, transformations, and table mappings
Custom Tables	Store detections, entities, and lockdown records
Parsers	Provide normalized KQL functions for querying Vectra data
Workbook Template	Provides the Vectra RUX Security Dashboard
Analytics Rule Templates	Provide incident creation rules for host and account detections
Playbooks / Logic Apps	Provide automation actions for enrichment, tagging, notes, assignments, and response workflows

Deployment

The connector supports two deployment modes depending on certification status.

Preview Deployment

During preview, customers deploy the solution using Deploy a custom template in Azure using a JSON ARM template provided by Vectra. The ARM template includes the full Microsoft Sentinel package: Data Connector, Parsers, Custom Log Analytics tables, Workbook template, Analytics rule templates, and Playbooks / Logic Apps.

After deployment, customers configure the connector from the Microsoft Sentinel Data connectors page, enable desired analytics rules, the security workbook, and configure playbooks as needed.

Content Hub Deployment

After certification, deployment will be performed through Microsoft Sentinel Content Hub. Customers will install the Vectra AI RUX solution from Content Hub, then configure the connector, enable analytics rule templates, save the workbook template if desired, and configure playbooks.

Data Connector

The connector polls the Vectra AI API using OAuth2 client credentials. Each connection requires a connection alias, Vectra API base URL, Client ID, Client Secret, and the selected data stream.

A Data Stream is an individual ingestion pipeline within the connector that retrieves a specific category of data from the Vectra AI API and writes it into a corresponding Log Analytics table. Each stream operates independently and defines the API endpoint being queried, the polling interval, the checkpoint or synchronization method, the target Log Analytics table, and the associated parser and transformation logic.

The three data streams within the Security Operations integration are:

Stream	Official Table	Parser	Checkpoint Method	Poll Interval
Detections	Detections_Data_CCF_CL	VectraRUXDetections	PersistentToken using next_checkpoint	5 minutes
Entities	Entities_Data_CCF_CL	VectraEntities	Sliding window using last_modified_timestamp_gte	10 minutes
Lockdown	Lockdown_Data_CCF_CL	VectraLockdown	Snapshot	5 minutes

Note: The previous Log Ingestion API (package version 3.3.0) uses table names without CCF (example: Detections_Data_CL). These tables are joined when populating the workbook to provide a better experience during the migration period after deploying this CCF version of the integration.

Detections Stream

The detections stream uses an event-based checkpointing model built around the Vectra /events/detections API endpoint. Each detection event in Vectra is assigned a serialized event ID. As new events occur, the ID increments monotonically.

After each successful polling cycle, events are ingested into Detections_Data_CCF_CL and the highest processed event ID is stored as the checkpoint. The next polling cycle resumes from that checkpoint, ensuring the connector always continues from the exact point where the previous ingestion cycle ended.

Because the checkpoint is ID-based rather than time-based:

• Poll timing does not affect data continuity

• Connector restarts do not cause gaps

• Temporary outages do not lose events

• Clock drift issues are avoided

Even if the connector does not poll again for several minutes, hours, or days, the next poll will continue from the last processed detection event ID.

Detection Polling Example

Initial checkpoint: 105000

Poll #1:
  Retrieves events 105001 → 105250
  Stores checkpoint 105250

Poll #2:
  Retrieves events 105251 → 105400
  Stores checkpoint 105400

Determining the Detections Starting Checkpoint Seed Value

When the connector is initially configured, a starting event ID must be provided. The connector requests all events occurring after that ID. The recommended approach depends on the deployment type.

Term	Meaning
Greenfield Deployment	No prior Vectra integration exists in Sentinel
Migration Deployment	A prior Vectra integration already exists and the customer is transitioning to the CCF connector

Greenfield Deployments — An API call to the Vectra platform is required to determine the seed value:

GET <vectraApiUrl>/api/v3.5/events/detections?limit=1&ordering=-id

Copy the returned next_checkpoint value into the detections starting checkpoint field.

Migration Deployments — When a previous integration exists, the most recent event retrieved from Vectra is available via KQL:

Detections_Data_CL
| summarize checkpoint = max(id)

Note: This query intentionally references the old table name Detections_Data_CL, as the previous integration has already populated data to a known point and the new connector should pick up from there.

Entities Stream

The entities stream uses time-based polling. The connector polls the Vectra entities endpoint every 10 minutes and retrieves entities modified since the previous polling window, using current_time - 10 minutes as the value for last_modified_timestamp_gte.

Example:

Current poll time: 14:00 UTC
Query parameter:   last_modified_timestamp_gte = 13:50 UTC

The entities stream continuously captures entity score changes, priority changes, assignment changes, state changes, tag updates, and entity metadata changes. Both host and account entities are included automatically.

Because the entities stream is time-window based, it does not maintain a serialized checkpoint and data continuity depends on successful polling intervals. Small overlap windows help reduce the chance of missed updates. This model is appropriate because entities represent continuously changing state (cumulative) rather than immutable event records.

Lockdown Stream

The lockdown stream uses a snapshot polling model. Every 5 minutes, the connector queries the current lockdown state from the Vectra API. If active lockdown records are returned, they are ingested into Lockdown_Data_CCF_CL.

The lockdown stream does not maintain a checkpoint because the API represents current state rather than historical events.

Important behavior: There is intentionally no post-processing deduplication for lockdown records. If an entity remains locked down for an extended period of time, the same lockdown record will be retrieved and ingested during every polling interval while the lockdown remains active.

Time	Result
12:00	Entity locked down
12:05	Same lockdown record ingested
12:10	Same lockdown record ingested
12:15	Same lockdown record ingested

This behavior is intentional. Repeated ingestion provides an operational audit trail showing that the entity remained continuously locked down throughout the observed period, and also allows operators to identify situations where a lockdown was manually removed, temporarily disappeared, or reinstated later. Because the stream represents observed state over time rather than unique events, duplicate records are expected behavior.

When evaluating current lockdown state, filter to recent records:

Lockdown_Data_CCF_CL
| where TimeGenerated > ago(15m)

To analyze historical lockdown continuity, query the full table without deduplication.

Parsers

Use the included parsers for workbooks, analytics rules, hunting, and operational queries rather than querying the raw tables directly.

Parser	Source Table	Purpose
VectraRUXDetections	Detections_Data_CCF_CL	Normalized detection data
VectraEntities	Entities_Data_CCF_CL	Normalized entity data
VectraLockdown	Lockdown_Data_CCF_CL	Normalized lockdown data

Recommended:

VectraRUXDetections
| take 10

Deduplication Guidance

Detection records may contain multiple updates for the same detection ID. Use arg_max() to evaluate the latest known state:

VectraRUXDetections
| summarize arg_max(TimeGenerated, *) by ["Detection ID"]

Installation & Configuration

Installing the Connector

Preview Installation

1. Open the Azure portal.

2. Search for Deploy a custom template.

3. Select Build your own template in the editor.

4. Paste or upload the provided Vectra AI RUX ARM template.

5. Select the subscription, resource group, and Sentinel workspace.

6. Deploy the template.

7. Open Microsoft Sentinel and navigate to Data connectors.

8. Open the Vectra RUX Security Data Connector.

9. Add one connection per data stream: Detections, Entities, Lockdown.

Content Hub Installation

1. Open Microsoft Sentinel.

2. Navigate to the desired workspace and select Content Hub.

3. Search for the Vectra RUX solution and select Install.

4. Configure the connector from Data connectors.

5. Enable analytics rule templates.

6. Save the workbook template if required.

7. Configure playbooks and automation rules as needed.

Connector Configuration

Create a separate Vectra API client for each data stream:

Stream	Recommended API Client
Detections	Sentinel-Detections (read-only)
Entities	Sentinel-Entities (read-only)
Lockdown	Sentinel-Lockdown (read-only)

Important: To avoid OAuth2 API rate limiting, stagger connection creation by at least one minute when adding multiple streams.

Verifying Data Flow

After 10–15 minutes, verify ingestion using the following queries.

Raw table verification:

Detections_Data_CCF_CL | take 10
Entities_Data_CCF_CL   | take 10
Lockdown_Data_CCF_CL   | take 10

Parser validation:

VectraRUXDetections | take 10
VectraEntities      | take 10
VectraLockdown      | take 10

Monitoring Connector Health

Microsoft Sentinel connector health information is written to the SentinelHealth table when auditing and health monitoring is enabled for the workspace.

Note: The CCF-based connector does not use Azure Function Apps and therefore does not generate Function App telemetry or Application Insights exceptions. Connector health should be monitored using Microsoft Sentinel's native connector health capabilities rather than Azure Monitor Function App alerts.

Enabling Health Monitoring

1. Open Microsoft Sentinel in the Azure portal.

2. Select your workspace and navigate to Configuration → Settings → Settings.

3. Select Auditing and health monitoring.

4. Select one of the following options:

Option	Description
Enable	Enables auditing and health monitoring for all supported Sentinel resource types
Configure diagnostic settings	Allows granular selection of monitored resource categories and destinations

For most deployments, selecting Enable is recommended. Microsoft Sentinel automatically creates the required diagnostic settings and begins sending health telemetry to the Log Analytics workspace.

The SentinelHealth table supports monitoring for Data connectors, Analytics rules, Automation rules, and Playbooks / Logic Apps.

Note: The SentinelHealth table is created automatically after the first health event is generated. This can take up to 30 minutes.

Verify ingestion using:

SentinelHealth | take 20

Recommended Connector Health Query

Returns the latest health state for the Vectra connector streams, filtered to failures only. This query is suitable for ad-hoc troubleshooting:

SentinelHealth
| where TimeGenerated > ago(24h)
| where SentinelResourceType == "Data connector"
| extend DestinationTable = tostring(ExtendedProperties.DestinationTable)
| extend StreamName = tostring(ExtendedProperties.StreamName)
| where DestinationTable in (
    "Detections_Data_CCF_CL",
    "Entities_Data_CCF_CL",
    "Lockdown_Data_CCF_CL"
  )
  or StreamName has_any (
    "Detections_Data_CCF_CL",
    "Entities_Data_CCF_CL",
    "Lockdown_Data_CCF_CL"
  )
| summarize arg_max(TimeGenerated, *) by DestinationTable
| project
    TimeGenerated,
    SentinelResourceName,
    DestinationTable,
    StreamName,
    Status,
    Description,
    Reason
| where Status != "Success"
| order by TimeGenerated desc

No results means there are no errors. Comment out the Status != "Success" line to review successful events as well.

Recommended Health Monitoring Alert Rule

The recommended monitoring approach for the CCF connector is a Scheduled Analytics Rule in Microsoft Sentinel.

Setting	Recommended Value
Rule Type	Scheduled
Query Frequency	15 minutes
Query Period	30 minutes
Trigger Threshold	Greater than 0
Severity	Medium
Incident Creation	Enabled

SentinelHealth
| where TimeGenerated > ago(30m)
| where SentinelResourceType == "Data connector"
| extend DestinationTable = tostring(ExtendedProperties.DestinationTable)
| where DestinationTable in (
    "Detections_Data_CCF_CL",
    "Entities_Data_CCF_CL",
    "Lockdown_Data_CCF_CL"
  )
| where Status != "Success"

Microsoft also provides the Data collection health monitoring workbook through Content Hub, which visualizes connector ingestion trends, anomalies, and connector health state over time. Install it from: Microsoft Sentinel → Content Hub → Data collection health monitoring.

Workbook

The solution includes the VectraRUXSecurityDashboard workbook template. This pre-built workbook provides visibility into entity scoring and prioritization, detection activity, escalated and prioritized detections, MITRE ATT&CK mappings, data source classification, lockdown state, entity-to-detection drilldowns, and deep links into Vectra.

Workbook Tabs & Filters

Tab	Description
Entity	Entity priority, urgency, scoring, assignment, and drilldown views
Detections	Detection investigation, category counts, MITRE filtering, and selected detection details
Lockdown	Lockdown status by entity, lock timestamp, unlock timestamp, and locking user

The workbook includes filters for time range, prioritized status, entity type, data source type, detection category, detection behavior, MITRE technique, and lockdown status. Supported data source categories include AWS, Azure, Entra ID/M365, and Network.

Opening and Saving the Workbook

To view the workbook:

1. Open Microsoft Sentinel and navigate to Workbooks.

2. Select the Templates tab.

3. Search for VectraRUXSecurityDashboard.

4. Select the workbook and choose View template.

To save the workbook to My workbooks:

1. Open the workbook from Templates.

2. Select Save.

3. Choose the subscription, resource group, and region.

4. Save the workbook.

Analytics Rules

The solution includes two Scheduled analytics rule templates — both rules should be enabled. These analytic rules create incidents for any detection that is prioritized (unresolved_priority = true) or has been manually escalated, regardless of priority. Two separate rules are required to ensure accurate entity mapping within Sentinel: hosts map to hostname, accounts map to username.

Rule Template	Purpose
Vectra RUX - Create Incident for Escalated Host Detection or Unresolved Priority Host	Creates incidents for host detections that are escalated or unresolved priority
Vectra RUX - Create Incident for Escalated Account Detection or Unresolved Priority Account	Creates incidents for account detections that are escalated or unresolved priority

Rule Logic & Queries

Trigger condition — An incident is created when either condition is true:

Investigation Status == "escalated"
OR
Unresolved Priority == true

Shared rule configuration:

Setting	Value
Rule type	Scheduled
Enabled by default	No
Severity	High
Query frequency	10 minutes
Query period	10 minutes
Trigger operator	Greater than
Trigger threshold	0
Event grouping	One alert per result
Incident creation	Enabled
Incident grouping lookback	7 days
Reopen closed incidents	False

Host Rule Query:

VectraRUXDetections
| where ["Entity Type"] == "host"
| summarize arg_max(TimeGenerated, *) by ["Detection ID"]
| where ["Investigation Status"] == "escalated" or ["Unresolved Priority"] == true
| extend
    detection_name       = ["D Type Vname"],
    detection_category   = ["Detection Category"],
    entity_url           = replace_string(replace_string(URL, "api/v3.4/", ""), "api/v3.5/", ""),
    mitre_techniques     = tostring(Mitre),
    detection_tags       = tostring(Tags),
    assigned_to          = ["Assigned To"],
    entity_name          = ["Entity Name"],
    entity_uid           = ["Entity UID"],
    entity_id            = ["Entity ID"],
    detection_id         = ["Detection ID"],
    external_reference   = ["External Reference"],
    investigation_status = ["Investigation Status"],
    entity_type          = ["Entity Type"]

Account Rule Query:

VectraRUXDetections
| where ["Entity Type"] == "account"
| summarize arg_max(TimeGenerated, *) by ["Detection ID"]
| where ["Investigation Status"] == "escalated" or ["Unresolved Priority"] == true
| extend
    detection_name       = ["D Type Vname"],
    detection_category   = ["Detection Category"],
    entity_url           = replace_string(replace_string(URL, "api/v3.4/", ""), "api/v3.5/", ""),
    mitre_techniques     = tostring(Mitre),
    detection_tags       = tostring(Tags),
    assigned_to          = ["Assigned To"],
    entity_name          = ["Entity Name"],
    entity_uid           = ["Entity UID"],
    entity_id            = ["Entity ID"],
    detection_id         = ["Detection ID"],
    external_reference   = ["External Reference"],
    investigation_status = ["Investigation Status"],
    entity_type          = ["Entity Type"]

Entity Mapping:

Rule	Sentinel Entity Type	Mapping
Host rule	Host	HostName → entity_name
Account rule	Account	Name → entity_name, UPNSuffix → entity_uid

Custom Alert Details — Each alert includes the following details extracted from Vectra: Detection ID, Detection Name, Detection Category, Entity ID, Entity UID, Entity URL, Entity Type, Tags, Assigned To, Investigation Status, External Reference, and MITRE Techniques.

Enabling Analytics Rules

1. Open Microsoft Sentinel and navigate to Analytics.

2. Select Rule templates.

3. Search for Vectra RUX.

4. Select each Vectra RUX rule template.

5. Select Create rule, review the configuration, and enable the rule.

Playbooks

The Vectra AI RUX solution includes 16 Microsoft Sentinel playbooks implemented as Azure Logic Apps. These playbooks extend Sentinel's SOAR capabilities, allowing analysts and automation workflows to interact directly with the Vectra AI platform for detection triage, entity management, assignment workflows, tagging, timeline synchronization, and PCAP evidence collection. The playbooks are connector-agnostic and work whether detections are ingested via the CCF connector or the legacy Function App connector.

Playbook Categories

Category	Purpose
Authentication	Generate and manage OAuth tokens
Detection Operations	Close, reopen, remediate, and tag detections
Entity Operations	Add notes, tags, assignments, and group membership
Incident Enrichment	Decorate incidents and synchronize timelines
Assignment and Triage	Assign ownership and resolve Vectra assignments
Notifications	Send Teams notifications and escalation prompts
Evidence Collection	Download PCAP files
Extensibility	Provide starter workflows for customization

Included Playbooks

Playbook	Purpose
VectraGenerateAccessToken	Generates OAuth access tokens for dependent playbooks
VectraCloseDetections	Closes one or more detections with a specified closure reason
VectraOpenClosedDetections	Reopens previously closed detections
VectraSetDetectionStatus	Automatically acknowledges or closes detections based on Sentinel incident status
VectraAddNoteToEntity	Adds notes to Vectra entities
VectraAddNoteToDetections	Adds notes to individual Vectra detections
VectraAddTagToEntity	Adds tags to Vectra entities
VectraAddTagToDetections	Adds tags to individual Vectra detections
VectraAddTagToSelectedDetections	Adds tags to analyst-selected detections
VectraAddTagToEntityAllDetections	Adds tags to all detections associated with an entity
VectraAssignDynamicUserToEntity	Allows analysts to dynamically select and assign a Vectra user
VectraAssignStaticUserToEntity	Assigns a predefined Vectra user to an entity
VectraStaticAssignMemberToGroup	Adds entities to a predefined group
VectraDynamicAssignMemberToGroup	Allows dynamic group selection and entity assignment
VectraIncidentTimelineUpdate	Synchronizes and deduplicates Sentinel incident timeline data
VectraDownloadPcapFileToStorage	Retrieves PCAP evidence from Vectra to Azure Storage

Best Practices & Operations

Operational best practices for the Vectra RUX integration with Microsoft Sentinel CCF are covered in the Vectra RUX Best Practices for Microsoft Sentinel guide. That document includes recommendations for data queries, parser usage, analytics rule configuration, connector operations, and SOC workflow guidance — including how to use automation rules and playbooks across the full incident lifecycle to accurately capture Vectra's MTTI and MTTR metrics.

Appendix: Data Schema

Detections_Data_CCF_CL

Column	Type	Description
TimeGenerated	datetime	Time the record was ingested or derived from the detection event timestamp
Type	string	Azure Log Analytics table type
TenantId	string	Azure tenant identifier
_ResourceId	string	Azure resource identifier
id	real	Autoincrementing event ID used for checkpointing
detection_id	real	Vectra detection ID
change_type	string	Detection event change type
event_timestamp	datetime	Timestamp of the detection event in Vectra
event_type	string	Vectra event type
category	string	Detection category
threat	real	Threat score
certainty	real	Certainty score
severity	real	Severity score
d_type_vname	string	Human-readable detection type name
triaged	bool	Whether the detection has been triaged
detail	dynamic	Raw detection detail payload
d_detection_details	dynamic	Detection details object
detection_href	string	Direct link to the detection
detection_type	string	Internal detection type identifier
entity_id	real	Associated entity ID
entity_uid	string	Associated entity unique identifier
entity_name	string	Associated entity name
entity_type	string	Associated entity type
url	string	Direct link to associated entity
mitre	dynamic	MITRE ATT&CK mappings
is_prioritized	bool	Whether the detection is prioritized
is_targeting_key_asset	string	Whether the detection targets a key asset
unresolved_priority	bool	Whether the detection is an unresolved priority
investigation_status	string	Vectra investigation status
reason	string	Reason or status context
src_host	dynamic	Source host object
src_host_id	long	Source host ID
src_host_ip	string	Source host IP address
src_ip	string	Source IP alias
src_host_name	string	Source host name
src_host_url	string	Source host URL
src_host_certainty	real	Source host certainty score
src_host_threat	real	Source host threat score
src_host_is_key_asset	bool	Whether source host is a key asset
src_host_groups	dynamic	Source host group memberships
src_account	dynamic	Source account object
src_account_id	long	Source account ID
src_account_name	string	Source account name
src_account_url	string	Source account URL
src_account_groups	dynamic	Source account group memberships
dst_host	dynamic	Destination host object
dst_host_id	long	Destination host ID
dst_host_ip	string	Destination host IP address
dst_host_name	string	Destination host name
dst_host_url	string	Destination host URL
dst_host_session_luid	string	Destination host session LUID
dst_host_groups	dynamic	Destination host group memberships
dst_account	dynamic	Destination account object
dst_account_id	long	Destination account ID
dst_account_name	string	Destination account name
dst_account_uid	string	Destination account UID
dst_account_url	string	Destination account URL
dst_account_groups	dynamic	Destination account group memberships
dst_domain	dynamic	Destination domain object
dst_domain_dns	string	Destination domain DNS value
dst_domain_domain	string	Destination domain name
dst_domain_external_target	string	Destination external target
src_external_host	dynamic	External source host object
src_external_host_ip	string	External source host IP
src_external_host_name	string	External source host name
data_source	dynamic	Data source object
data_source_sensor_id	string	Sensor ID
data_source_sensor_name	string	Sensor name
data_source_type	string	Data source type
filters	dynamic	Filter metadata
filters_filtered_by_ai	bool	Whether filtered by AI
filters_filtered_by_rule	bool	Whether filtered by rule
filters_filtered_by_user	bool	Whether filtered by user
filters_is_custom_model	bool	Whether custom model filtering applied
filters_triaged	bool	Filter triage state
assignment	dynamic	Assignment object
assignment_id	long	Assignment ID
assignment_assigned_by	dynamic	Assigned-by user object
assignment_assigned_by_id	long	Assigned-by user ID
assignment_assigned_by_username	string	Assigned-by username
assignment_assigned_to	dynamic	Assigned-to user object
assignment_assigned_to_id	long	Assigned-to user ID
assignment_assigned_to_username	string	Assigned-to username
assignment_date_assigned	datetime	Assignment date
summary	dynamic	Detection summary
grouped_details	dynamic	Grouped detection details
tags	dynamic	Detection tags
normal_domains	dynamic	Normal domain context
external_reference_id	string	External ticket or case reference ID
process_context_data	dynamic	EDR or process context data

Entities_Data_CCF_CL

Column	Type	Description
TimeGenerated	datetime	Time the record was ingested or derived from last modified timestamp
Type	string	Azure Log Analytics table type
TenantId	string	Azure tenant identifier
_ResourceId	string	Azure resource identifier
id	real	Vectra entity ID
name	string	Entity name
breadth_contrib	real	Breadth contribution to urgency
importance	real	Entity importance score
entity_type	string	Entity type
is_prioritized	bool	Whether the entity is prioritized
severity	string	Entity severity
urgency_score	real	Urgency score
velocity_contrib	real	Velocity contribution
detection_set	dynamic	Associated detection set
last_detection_timestamp	datetime	Timestamp of latest detection
last_modified_timestamp	datetime	Last entity modification timestamp
notes	dynamic	Entity notes
attack_rating	real	Attack rating
privilege_level	real	Privilege level
privilege_category	string	Privilege category
attack_profile	string	Attack profile
sensors	dynamic	Associated sensors
state	string	Entity state
tags	dynamic	Entity tags
url	string	Entity URL
host_type	dynamic	Host type details
account_type	dynamic	Account type details
ip	string	IP address
assignment	dynamic	Raw assignment object
assignment_id	real	Assignment ID
assignment_assigned_by	dynamic	Assigned-by user object
assignment_assigned_by_id	real	Assigned-by user ID
assignment_assigned_by_username	string	Assigned-by username
assignment_date_assigned	datetime	Assignment date
assignment_assigned_to	dynamic	Assigned-to user object
assignment_assigned_to_id	real	Assigned-to user ID
assignment_assigned_to_username	string	Assigned-to username

Lockdown_Data_CCF_CL

Column	Type	Description
TimeGenerated	datetime	Time the record was ingested or derived from lock event timestamp
Type	string	Azure Log Analytics table type
TenantId	string	Azure tenant identifier
_ResourceId	string	Azure resource identifier
id	real	Lockdown record ID
lock_event_timestamp	datetime	Time lockdown was applied
locked_by	string	User who initiated lockdown
unlock_event_timestamp	datetime	Time lockdown expires or was removed
entity_id	real	Locked entity ID
entity_name	string	Locked entity name
entity_type	string	Locked entity type
certainty	real	Certainty score retained for backward compatibility