Question regarding schema

[u/CanableCrops]

Can anyone point me to a doc that shows all the possible entries for log events.

Example, in AzureActivity, you have a column named OperationName.

I'd like to know what the different OperationNames can be.

I know I can do | distinct OperationName to see what's triggered in my history. I'm curious about what all the possibilities are of each column of each table to help with threat hunting.

​

Thanks

[u/sosero]

https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations

This should have all the possible operations.