{
  "properties": {
    "plan": "Analytics",
    "retentionInDays": 30,
    "schema": {
      "name": "DTAudit_CL",
      "columns": [
        {
          "name": "TimeGenerated",
          "type": "dateTime"
        },
        {
          "name": "EventName",
          "type": "string"
        },
        {
          "name": "SchemaVersion",
          "type": "int"
        },
        {
          "name": "EventId",
          "type": "string"
        },
        {
          "name": "OrganizationId",
          "type": "string"
        },
        {
          "name": "OccurredAt",
          "type": "string"
        },
        {
          "name": "CapturedAt",
          "type": "string"
        },
        {
          "name": "ActorKind",
          "type": "string"
        },
        {
          "name": "ActorUserId",
          "type": "string"
        },
        {
          "name": "Category",
          "type": "string"
        },
        {
          "name": "Action",
          "type": "string"
        },
        {
          "name": "Result",
          "type": "string"
        },
        {
          "name": "ResourceType",
          "type": "string"
        },
        {
          "name": "ResourceId",
          "type": "string"
        },
        {
          "name": "SourceKind",
          "type": "string"
        },
        {
          "name": "SourceId",
          "type": "string"
        },
        {
          "name": "CorrelationId",
          "type": "string"
        },
        {
          "name": "Body",
          "type": "string"
        },
        {
          "name": "TimestampNs",
          "type": "string"
        },
        {
          "name": "ObservedTimestampNs",
          "type": "string"
        },
        {
          "name": "ServiceName",
          "type": "string"
        },
        {
          "name": "ServiceVersion",
          "type": "string"
        },
        {
          "name": "DeploymentEnvironment",
          "type": "string"
        },
        {
          "name": "ScopeName",
          "type": "string"
        },
        {
          "name": "SeverityNumber",
          "type": "long"
        },
        {
          "name": "SeverityText",
          "type": "string"
        },
        {
          "name": "ActorServiceIdentityId",
          "type": "string"
        },
        {
          "name": "SecurityAgentId",
          "type": "string"
        },
        {
          "name": "SecurityWorkItemId",
          "type": "string"
        },
        {
          "name": "SecurityExternalEventHmac",
          "type": "string"
        },
        {
          "name": "SecurityWorkKnown",
          "type": "long"
        },
        {
          "name": "SecurityWorkCancellationRequested",
          "type": "long"
        },
        {
          "name": "SecurityWorkCancelled",
          "type": "long"
        },
        {
          "name": "SecurityWorkTerminal",
          "type": "long"
        },
        {
          "name": "SecurityWorkUnknown",
          "type": "long"
        },
        {
          "name": "SecurityWorkFailed",
          "type": "long"
        },
        {
          "name": "ClientIp",
          "type": "string"
        },
        {
          "name": "SessionDigest",
          "type": "string"
        },
        {
          "name": "DestinationClass",
          "type": "string"
        },
        {
          "name": "DestinationState",
          "type": "string"
        },
        {
          "name": "DestinationAgentId",
          "type": "string"
        },
        {
          "name": "DestinationIdentity",
          "type": "string"
        },
        {
          "name": "DestinationPreviousIdentity",
          "type": "string"
        },
        {
          "name": "DestinationPolicyGeneration",
          "type": "long"
        },
        {
          "name": "DestinationBoundary",
          "type": "string"
        },
        {
          "name": "DestinationTransportState",
          "type": "string"
        },
        {
          "name": "DestinationMode",
          "type": "string"
        },
        {
          "name": "DestinationEvaluationId",
          "type": "string"
        }
      ]
    }
  }
}