Platform Update v2.6.16

KQL gets simpler column names and four new table schemas: Office 365, Windows audit events, Google Workspace and AWS CloudTrail.

Changes

KQL

• Root fields. A table schema can declare a root field, so a query names a column directly — EventID instead of ["@fields.EventID"].
• Labels. An event's @labels maps to a labels column.
• New schemas: Office365, WindowsAudit, GSuite and CloudTrail.

For example, the busiest Windows event IDs over the last day:

WindowsAudit
| where timestamp > ago(1d)
| summarize Events = count() by EventID
| order by Events desc

See KQL and Schemas.

Reliability

• EventWatch and behavior signals move to a more durable internal queue.
• Housekeeping fixes to the data lake and file storage services.