{
  "location": "<workspace-region>",
  "kind": "Direct",
  "properties": {
    "streamDeclarations": {
      "Custom-DTAudit": {
        "columns": [
          {
            "name": "TimeGenerated",
            "type": "datetime"
          },
          {
            "name": "EventName",
            "type": "string"
          },
          {
            "name": "SchemaVersion",
            "type": "int"
          },
          {
            "name": "EventId",
            "type": "string"
          },
          {
            "name": "OrganizationId",
            "type": "string"
          },
          {
            "name": "OccurredAt",
            "type": "string"
          },
          {
            "name": "CapturedAt",
            "type": "string"
          },
          {
            "name": "ActorKind",
            "type": "string"
          },
          {
            "name": "ActorUserId",
            "type": "string"
          },
          {
            "name": "Category",
            "type": "string"
          },
          {
            "name": "Action",
            "type": "string"
          },
          {
            "name": "Result",
            "type": "string"
          },
          {
            "name": "ResourceType",
            "type": "string"
          },
          {
            "name": "ResourceId",
            "type": "string"
          },
          {
            "name": "SourceKind",
            "type": "string"
          },
          {
            "name": "SourceId",
            "type": "string"
          },
          {
            "name": "CorrelationId",
            "type": "string"
          },
          {
            "name": "Body",
            "type": "string"
          },
          {
            "name": "TimestampNs",
            "type": "string"
          },
          {
            "name": "ObservedTimestampNs",
            "type": "string"
          },
          {
            "name": "ServiceName",
            "type": "string"
          },
          {
            "name": "ServiceVersion",
            "type": "string"
          },
          {
            "name": "DeploymentEnvironment",
            "type": "string"
          },
          {
            "name": "ScopeName",
            "type": "string"
          },
          {
            "name": "SeverityNumber",
            "type": "long"
          },
          {
            "name": "SeverityText",
            "type": "string"
          },
          {
            "name": "ActorServiceIdentityId",
            "type": "string"
          },
          {
            "name": "SecurityAgentId",
            "type": "string"
          },
          {
            "name": "SecurityWorkItemId",
            "type": "string"
          },
          {
            "name": "SecurityExternalEventHmac",
            "type": "string"
          },
          {
            "name": "SecurityWorkKnown",
            "type": "long"
          },
          {
            "name": "SecurityWorkCancellationRequested",
            "type": "long"
          },
          {
            "name": "SecurityWorkCancelled",
            "type": "long"
          },
          {
            "name": "SecurityWorkTerminal",
            "type": "long"
          },
          {
            "name": "SecurityWorkUnknown",
            "type": "long"
          },
          {
            "name": "SecurityWorkFailed",
            "type": "long"
          },
          {
            "name": "ClientIp",
            "type": "string"
          },
          {
            "name": "SessionDigest",
            "type": "string"
          },
          {
            "name": "DestinationClass",
            "type": "string"
          },
          {
            "name": "DestinationState",
            "type": "string"
          },
          {
            "name": "DestinationAgentId",
            "type": "string"
          },
          {
            "name": "DestinationIdentity",
            "type": "string"
          },
          {
            "name": "DestinationPreviousIdentity",
            "type": "string"
          },
          {
            "name": "DestinationPolicyGeneration",
            "type": "long"
          },
          {
            "name": "DestinationBoundary",
            "type": "string"
          },
          {
            "name": "DestinationTransportState",
            "type": "string"
          },
          {
            "name": "DestinationMode",
            "type": "string"
          },
          {
            "name": "DestinationEvaluationId",
            "type": "string"
          }
        ]
      },
      "Custom-DTAgentAudit": {
        "columns": [
          {
            "name": "TimeGenerated",
            "type": "datetime"
          },
          {
            "name": "EventName",
            "type": "string"
          },
          {
            "name": "SchemaVersion",
            "type": "int"
          },
          {
            "name": "EventId",
            "type": "string"
          },
          {
            "name": "OrganizationId",
            "type": "string"
          },
          {
            "name": "OccurredAt",
            "type": "string"
          },
          {
            "name": "CapturedAt",
            "type": "string"
          },
          {
            "name": "ActorKind",
            "type": "string"
          },
          {
            "name": "ActorUserId",
            "type": "string"
          },
          {
            "name": "Category",
            "type": "string"
          },
          {
            "name": "Action",
            "type": "string"
          },
          {
            "name": "Result",
            "type": "string"
          },
          {
            "name": "ResourceType",
            "type": "string"
          },
          {
            "name": "ResourceId",
            "type": "string"
          },
          {
            "name": "SourceKind",
            "type": "string"
          },
          {
            "name": "SourceId",
            "type": "string"
          },
          {
            "name": "EventHash",
            "type": "string"
          },
          {
            "name": "EventSequence",
            "type": "long"
          },
          {
            "name": "RunId",
            "type": "string"
          },
          {
            "name": "AgentId",
            "type": "string"
          },
          {
            "name": "TriggerType",
            "type": "string"
          },
          {
            "name": "Phase",
            "type": "string"
          },
          {
            "name": "AuthoritySource",
            "type": "string"
          },
          {
            "name": "ApprovalState",
            "type": "string"
          },
          {
            "name": "Risk",
            "type": "string"
          },
          {
            "name": "CoverageQuality",
            "type": "string"
          },
          {
            "name": "ModelCompletionId",
            "type": "string"
          },
          {
            "name": "ModelConfiguredModel",
            "type": "string"
          },
          {
            "name": "ModelConfiguredProvider",
            "type": "string"
          },
          {
            "name": "ModelCallId",
            "type": "string"
          },
          {
            "name": "ModelRunId",
            "type": "string"
          },
          {
            "name": "ModelParentStepId",
            "type": "string"
          },
          {
            "name": "ModelParentCallId",
            "type": "string"
          },
          {
            "name": "ModelStatus",
            "type": "string"
          },
          {
            "name": "ModelDisposition",
            "type": "string"
          },
          {
            "name": "ModelReturnedModel",
            "type": "string"
          },
          {
            "name": "ModelReportedProvider",
            "type": "string"
          },
          {
            "name": "ModelProviderSource",
            "type": "string"
          },
          {
            "name": "ModelFinishReason",
            "type": "string"
          },
          {
            "name": "ModelCostUsd",
            "type": "string"
          },
          {
            "name": "ModelCostSource",
            "type": "string"
          },
          {
            "name": "ModelDurationMs",
            "type": "long"
          },
          {
            "name": "ModelAttemptCount",
            "type": "long"
          },
          {
            "name": "ModelCallDurationMs",
            "type": "long"
          },
          {
            "name": "ModelPromptTokens",
            "type": "long"
          },
          {
            "name": "ModelOutputTokens",
            "type": "long"
          },
          {
            "name": "ModelCachedTokens",
            "type": "long"
          },
          {
            "name": "ModelAttemptId",
            "type": "string"
          },
          {
            "name": "ModelAttemptStatus",
            "type": "string"
          },
          {
            "name": "ModelAttemptDisposition",
            "type": "string"
          },
          {
            "name": "ModelAttemptConfiguredModel",
            "type": "string"
          },
          {
            "name": "ModelAttemptConfiguredProvider",
            "type": "string"
          },
          {
            "name": "ModelAttemptErrorCode",
            "type": "string"
          },
          {
            "name": "ModelAttemptOrganizationUsageId",
            "type": "string"
          },
          {
            "name": "ModelAttemptSequence",
            "type": "long"
          },
          {
            "name": "ModelAttemptHttpStatus",
            "type": "long"
          },
          {
            "name": "ModelAttemptDurationMs",
            "type": "long"
          },
          {
            "name": "Body",
            "type": "string"
          },
          {
            "name": "TimestampNs",
            "type": "string"
          },
          {
            "name": "ObservedTimestampNs",
            "type": "string"
          },
          {
            "name": "ServiceName",
            "type": "string"
          },
          {
            "name": "ServiceVersion",
            "type": "string"
          },
          {
            "name": "DeploymentEnvironment",
            "type": "string"
          },
          {
            "name": "ScopeName",
            "type": "string"
          },
          {
            "name": "SeverityNumber",
            "type": "long"
          },
          {
            "name": "SeverityText",
            "type": "string"
          },
          {
            "name": "FlowCategory",
            "type": "string"
          },
          {
            "name": "FlowDirection",
            "type": "string"
          },
          {
            "name": "CounterpartyOrigins",
            "type": "string"
          },
          {
            "name": "CounterpartyEmailDomains",
            "type": "string"
          },
          {
            "name": "CounterpartyCount",
            "type": "long"
          },
          {
            "name": "DestinationPolicyGeneration",
            "type": "long"
          },
          {
            "name": "DestinationBoundary",
            "type": "string"
          },
          {
            "name": "DestinationTransportState",
            "type": "string"
          },
          {
            "name": "DestinationMode",
            "type": "string"
          },
          {
            "name": "DestinationEvaluationId",
            "type": "string"
          }
        ]
      }
    },
    "destinations": {
      "logAnalytics": [
        {
          "workspaceResourceId": "<workspace-resource-id>",
          "name": "audit-workspace"
        }
      ]
    },
    "dataFlows": [
      {
        "streams": [
          "Custom-DTAudit"
        ],
        "destinations": [
          "audit-workspace"
        ],
        "transformKql": "source",
        "outputStream": "Custom-DTAudit_CL"
      },
      {
        "streams": [
          "Custom-DTAgentAudit"
        ],
        "destinations": [
          "audit-workspace"
        ],
        "transformKql": "source",
        "outputStream": "Custom-DTAgentAudit_CL"
      }
    ]
  }
}