CIM field change report

Learn about the CIM field changes between the latest version of the Splunk Add-on for Microsoft Cloud Services and version 4.1.4.

Summary of changes

• Sourcetypes with changes: 18
• Total deleted fields: 2
• Total modified fields: 6
• Total new fields: 302

Detailed changes

azure:monitor:aad

Field	Deleted	Modified	New	Is CIM
Email	no	no	yes	no
InvitationId	no	no	yes	no
ObjectId	no	no	yes	no
UPN	no	no	yes	no
UserObjectId	no	no	yes	no
action	no	no	yes	yes
additional_details	no	no	yes	no
additional_details_name	no	no	yes	no
additional_details_value	no	no	yes	no
app	no	no	yes	yes
authentication_method	no	no	yes	yes
authentication_service	no	no	yes	yes
change_type	no	no	yes	yes
command	no	no	yes	yes
dataset_name	no	no	yes	no
description	no	no	yes	yes
dest	no	no	yes	yes
dest_type	no	no	yes	yes
duration	no	no	yes	yes
dvc	no	no	yes	yes
enabled	no	no	yes	yes
eventtype	no	no	yes	yes
id	no	no	yes	yes
object	no	no	yes	yes
object_attrs	no	no	yes	yes
object_attrs_from_resultReason	no	no	yes	no
object_category	no	no	yes	yes
object_id	no	no	yes	yes
object_path	no	no	yes	yes
path_from_resourceId	no	no	yes	no
properties.additionalDetails{}.key	no	no	yes	no
properties.additionalDetails{}.value	no	no	yes	no
properties.targetResources{}.modifiedProperties{}.newValue	no	no	yes	no
reason	no	no	yes	yes
response_time	no	no	yes	yes
result	no	no	yes	yes
result_id	no	no	yes	yes
severity	no	no	yes	yes
signature	no	no	yes	yes
signature_id	no	no	yes	yes
signinDateTime	no	no	yes	no
src	no	no	yes	yes
src_ip	no	no	yes	yes
src_user	no	no	yes	yes
src_user_name	no	no	yes	yes
src_user_type	no	no	yes	yes
status	no	no	yes	yes
tag	no	no	yes	yes
tag::eventtype	no	no	yes	no
type	no	no	yes	yes
user	no	no	yes	yes
user_agent	no	no	yes	yes
user_id	no	no	yes	yes
user_name	no	no	yes	yes
user_role	no	no	yes	yes
user_type	no	no	yes	yes
vendor_account	no	no	yes	yes
vendor_product	no	no	yes	yes
vendor_region	no	no	yes	yes

azure:monitor:activity

Field	Deleted	Modified	New	Is CIM
ResourceGroup	no	no	yes	no
Subscription	no	no	yes	no
action	no	no	yes	yes
blobservice	no	no	yes	no
change_type	no	no	yes	yes
command	no	no	yes	yes
dataset_name	no	no	yes	no
dest	no	no	yes	yes
dvc	no	no	yes	yes
eventhub_name	no	no	yes	no
eventtype	no	no	yes	yes
image_id	no	no	yes	yes
instance_type	no	no	yes	yes
instance_type_value	no	no	yes	no
namespace	no	no	yes	no
object	no	no	yes	yes
object_attrs	no	no	yes	yes
object_category	no	no	yes	yes
object_from_sites	no	no	yes	no
object_id	no	no	yes	yes
object_name	no	no	yes	no
object_path	no	no	yes	yes
properties.entity	no	no	yes	no
properties.hierarchy	no	no	yes	no
properties.message	no	no	yes	no
publisher	no	no	yes	no
resource_group	no	no	yes	no
resource_provider	no	no	yes	no
resource_provider_from_resource_id	no	no	yes	no
response_body	no	no	yes	no
result	no	no	yes	yes
result_id	no	no	yes	yes
sku	no	no	yes	no
src	no	no	yes	yes
status	no	no	yes	yes
storage_acc_name	no	no	yes	no
storage_account	no	no	yes	no
subscription_id	no	no	yes	no
tag	no	no	yes	yes
tag::eventtype	no	no	yes	no
tenantId	no	no	yes	no
user	no	no	yes	yes
user_name	no	no	yes	yes
user_type	no	no	yes	yes
vendor_account	no	no	yes	yes
vendor_product	no	no	yes	yes
vendor_region	no	no	yes	yes
version	no	no	yes	yes
vm_name	no	no	yes	no
web_app_name	no	no	yes	no
workspace_name	no	no	yes	no

azure:monitor:resource

Field	Deleted	Modified	New	Is CIM
ACCOUNTS	no	no	yes	no
DATABASEACCOUNTS	no	no	yes	no
PROVIDERS	no	no	yes	no
RESOURCEGROUPS	no	no	yes	no
RHCStatus	no	no	yes	no
SUBSCRIPTIONS	no	no	yes	no
account	no	no	yes	no
action	no	no	yes	yes
app	no	no	yes	yes
change_type	no	no	yes	yes
command	no	no	yes	yes
company	no	no	yes	no
consumerName	no	no	yes	no
dest	no	no	yes	yes
dest_name	no	no	yes	yes
destinationLocation	no	no	yes	no
detailMessage	no	no	yes	no
duration	no	no	yes	yes
dvc	no	no	yes	yes
endTime	no	no	yes	no
eventtype	no	no	yes	yes
object	no	no	yes	yes
object_attrs	no	no	yes	yes
object_category	no	no	yes	yes
object_id	no	no	yes	yes
object_name_before_slash	no	no	yes	no
object_name_controlplane	no	no	yes	no
object_name_dataplane	no	no	yes	no
object_path	no	no	yes	yes
parent_object	no	no	yes	yes
parent_object_category	no	no	yes	yes
parent_object_id	no	no	yes	yes
providerName	no	no	yes	no
recipient	no	no	yes	yes
resourcedetails_key	no	no	yes	no
resourcedetails_value	no	no	yes	no
result	no	no	yes	yes
result_id	no	no	yes	yes
shareResourceId	no	no	yes	no
shareSubscriptionResourceId	no	no	yes	no
shareSubscriptions	no	no	yes	no
shares	no	no	yes	no
sourceLocation	no	no	yes	no
src	no	no	yes	yes
startTime	no	no	yes	no
status	no	no	yes	yes
syncDuration	no	no	yes	no
synchronizationId	no	no	yes	no
tag	no	no	yes	yes
tag::eventtype	no	no	yes	no
tenant_id	no	no	yes	no
triggerType	no	no	yes	no
user	no	no	yes	yes
user_agent	no	no	yes	yes
user_name	no	no	yes	yes
vendor_account	no	no	yes	yes
vendor_product	no	no	yes	yes
vendor_region	no	no	yes	yes

mscs:azure:audit

Field	Deleted	Modified	New	Is CIM
action	no	no	yes	yes
app	no	no	yes	yes
change_type	no	no	yes	yes
description	yes	yes	no	yes
dest	no	no	yes	yes
dvc	no	no	yes	yes
event_description	no	no	yes	no
eventtype	no	no	yes	yes
object	no	no	yes	yes
object_attrs	no	no	yes	yes
object_category	no	no	yes	yes
object_id	no	no	yes	yes
object_path	no	no	yes	yes
operationName.localizedValue	no	yes	no	no
product	no	no	yes	no
result	no	no	yes	yes
result_id	no	no	yes	yes
severity	no	no	yes	yes
signature	no	no	yes	yes
signature_id	no	no	yes	yes
src	no	no	yes	yes
status	no	no	yes	yes
subStatus.localizedValue	yes	no	no	no
tag	no	no	yes	yes
tag::eventtype	no	no	yes	no
type	no	no	yes	yes
user	no	no	yes	yes
user_name	no	no	yes	yes
vendor	no	no	yes	no
vendor_product	no	no	yes	yes
vendor_res_code	no	no	yes	no

mscs:azure:security:alert

Field	Deleted	Modified	New	Is CIM
dest_type	no	yes	no	yes
recommendation	no	no	yes	no
resource_group	no	no	yes	no
src	no	no	yes	yes
subscription_id	no	no	yes	no
user	no	no	yes	yes
user_name	no	no	yes	yes

mscs:azure:security:recommendation

Field	Deleted	Modified	New	Is CIM
resource_group	no	no	yes	no
severity	no	no	yes	yes
subscription_id	no	no	yes	no

mscs:metrics:events

Field	Deleted	Modified	New	Is CIM
time	no	no	yes	yes

mscs:resource:disk

Field	Deleted	Modified	New	Is CIM
description	no	no	yes	yes
dest	no	no	yes	yes
eventtype	no	no	yes	yes
family	no	no	yes	yes
hypervisor_id	no	no	yes	yes
mount	no	no	yes	yes
parent	no	no	yes	yes
read_blocks	no	no	yes	yes
read_ops	no	no	yes	yes
resource_group	no	no	yes	no
serial	no	no	yes	yes
status	no	no	yes	yes
storage	no	no	yes	yes
subscription_id	no	no	yes	no
tag	no	no	yes	yes
tag::eventtype	no	no	yes	no
vendor_product	no	no	yes	yes
version	no	no	yes	yes
write_blocks	no	no	yes	yes
write_ops	no	no	yes	yes

mscs:resource:image

Field	Deleted	Modified	New	Is CIM
description	no	no	yes	yes
dest	no	no	yes	yes
eventtype	no	no	yes	yes
family	no	no	yes	yes
hypervisor_id	no	no	yes	yes
resource_group	no	no	yes	no
status	no	no	yes	yes
subscription_id	no	no	yes	no
tag	no	no	yes	yes
tag::eventtype	no	no	yes	no
vendor_product	no	no	yes	yes
version	no	no	yes	yes

mscs:resource:networkInterfaceCard

Field	Deleted	Modified	New	Is CIM
dest	no	no	yes	yes
eventtype	no	yes	no	yes
interface	no	no	yes	yes
product	no	no	yes	no
resource_group	no	no	yes	no
subscription_id	no	no	yes	no
tag	no	yes	no	yes
tag::eventtype	no	yes	no	no
vendor	no	no	yes	no
vendor_product	no	no	yes	yes

mscs:resource:publicIPAddress

Field	Deleted	Modified	New	Is CIM
resource_group	no	no	yes	no
subscription_id	no	no	yes	no

mscs:resource:resourceGroup

Field	Deleted	Modified	New	Is CIM
description	no	no	yes	yes
dest	no	no	yes	yes
eventtype	no	no	yes	yes
family	no	no	yes	yes
resource_group	no	no	yes	no
status	no	no	yes	yes
subscription_id	no	no	yes	no
tag	no	no	yes	yes
tag::eventtype	no	no	yes	no
vendor_product	no	no	yes	yes

mscs:resource:securityGroup

Field	Deleted	Modified	New	Is CIM
description	no	no	yes	yes
dest	no	no	yes	yes
eventtype	no	no	yes	yes
family	no	no	yes	yes
resource_group	no	no	yes	no
serial	no	no	yes	yes
status	no	no	yes	yes
subscription_id	no	no	yes	no
tag	no	no	yes	yes
tag::eventtype	no	no	yes	no
vendor_product	no	no	yes	yes

mscs:resource:snapshot

Field	Deleted	Modified	New	Is CIM
description	no	no	yes	yes
dest	no	no	yes	yes
eventtype	no	no	yes	yes
family	no	no	yes	yes
resource_group	no	no	yes	no
size	no	no	yes	yes
snapshot	no	no	yes	yes
status	no	no	yes	yes
subscription_id	no	no	yes	no
tag	no	no	yes	yes
tag::eventtype	no	no	yes	no
time	no	no	yes	yes
vendor_product	no	no	yes	yes

mscs:resource:subscriptions

Field	Deleted	Modified	New	Is CIM
description	no	no	yes	yes
dest	no	no	yes	yes
enabled	no	no	yes	yes
eventtype	no	no	yes	yes
family	no	no	yes	yes
serial	no	no	yes	yes
status	no	no	yes	yes
tag	no	no	yes	yes
tag::eventtype	no	no	yes	no
vendor_product	no	no	yes	yes

mscs:resource:topology

Field	Deleted	Modified	New	Is CIM
resourceType	no	no	yes	no
topo_resource_group	no	no	yes	no
topo_subnet	no	no	yes	no
topo_subscription_id	no	no	yes	no
topo_vnet	no	no	yes	no

mscs:resource:virtualMachine

Field	Deleted	Modified	New	Is CIM
image_name	no	no	yes	no
ip	no	no	yes	yes
resource_group	no	no	yes	no
subscription_id	no	no	yes	no

mscs:resource:virtualNetwork

Field	Deleted	Modified	New	Is CIM
resource_group	no	no	yes	no
subscription_id	no	no	yes	no