Microsoft Sentinel Archive CLI Outputs

set-tier.json

{
  "archiveRetentionInDays": 60,
  "id": "/subscriptions/my-subscription-id/resourcegroups/myresourcegroup/providers/Microsoft.OperationalInsights/workspaces/mysentinelworkspace/tables/Syslog",
  "lastPlanModifiedDate": null,
  "name": "Syslog",
  "plan": "Analytics",
  "provisioningState": "Succeeded",
  "resourceGroup": "myresourcegroup",
  "restoredLogs": null,
  "resultStatistics": null,
  "retentionInDays": 30,
  "schema": {
    "categories": null,
    "columns": null,
    "description": null,
    "displayName": null,
    "labels": null,
    "name": "Syslog",
    "restoredLogs": null,
    "searchResults": null,
    "solutions": [
      "LogManagement"
    ],
    "source": null,
    "standardColumns": [
      {
        "dataTypeHint": null,
        "description": "ID of the workspace that stores this record",
        "displayName": null,
        "isDefaultDisplay": true,
        "isHidden": true,
        "name": "TenantId",
        "type": "guid"
      },
      {
        "dataTypeHint": null,
        "description": "Type of agent the data was collected from. For syslog the value is typically Linux.",
        "displayName": null,
        "isDefaultDisplay": true,
        "isHidden": false,
        "name": "SourceSystem",
        "type": "string"
      },
      {
        "dataTypeHint": null,
        "description": "Date and time the record was created.",
        "displayName": null,
        "isDefaultDisplay": true,
        "isHidden": false,
        "name": "TimeGenerated",
        "type": "datetime"
      },
      {
        "dataTypeHint": null,
        "description": "ID of the management group for System Center Operations Manager agents.",
        "displayName": null,
        "isDefaultDisplay": true,
        "isHidden": true,
        "name": "MG",
        "type": "guid"
      },
      {
        "dataTypeHint": null,
        "description": null,
        "displayName": null,
        "isDefaultDisplay": true,
        "isHidden": true,
        "name": "TimeCollected",
        "type": "datetime"
      },
      {
        "dataTypeHint": null,
        "description": null,
        "displayName": null,
        "isDefaultDisplay": true,
        "isHidden": false,
        "name": "ManagementGroupName",
        "type": "string"
      },
      {
        "dataTypeHint": null,
        "description": "Computer that the event was collected from.",
        "displayName": null,
        "isDefaultDisplay": true,
        "isHidden": false,
        "name": "Computer",
        "type": "string"
      },
      {
        "dataTypeHint": null,
        "description": "Date and time that the event was generated.",
        "displayName": null,
        "isDefaultDisplay": true,
        "isHidden": false,
        "name": "EventTime",
        "type": "datetime"
      },
      {
        "dataTypeHint": null,
        "description": "The part of the system that generated the message.",
        "displayName": null,
        "isDefaultDisplay": true,
        "isHidden": false,
        "name": "Facility",
        "type": "string"
      },
      {
        "dataTypeHint": null,
        "description": "Name of the system sending the message.",
        "displayName": null,
        "isDefaultDisplay": true,
        "isHidden": false,
        "name": "HostName",
        "type": "string"
      },
      {
        "dataTypeHint": null,
        "description": "Severity level of the event.",
        "displayName": null,
        "isDefaultDisplay": true,
        "isHidden": false,
        "name": "SeverityLevel",
        "type": "string"
      },
      {
        "dataTypeHint": null,
        "description": "Text of the message.",
        "displayName": null,
        "isDefaultDisplay": true,
        "isHidden": false,
        "name": "SyslogMessage",
        "type": "string"
      },
      {
        "dataTypeHint": null,
        "description": "ID of the process that generated the message.",
        "displayName": null,
        "isDefaultDisplay": true,
        "isHidden": false,
        "name": "ProcessID",
        "type": "int"
      },
      {
        "dataTypeHint": null,
        "description": "IP address of the system sending the message.",
        "displayName": null,
        "isDefaultDisplay": true,
        "isHidden": false,
        "name": "HostIP",
        "type": "string"
      },
      {
        "dataTypeHint": null,
        "description": "Name of the process that generated the message.",
        "displayName": null,
        "isDefaultDisplay": true,
        "isHidden": false,
        "name": "ProcessName",
        "type": "string"
      }
    ],
    "tableSubType": "Any",
    "tableType": "Microsoft"
  },
  "searchResults": null,
  "systemData": null,
  "totalRetentionInDays": 90,
  "type": null
}