...
Common fields for all SharePoint sub-types
Field | Description |
|---|---|
SITE |
Based on Site, where this field contains the GUID of the site where the file or folder accessed by the user is located. |
ITEMTYPE |
Based on ItemType, where this field contains the details about the type of object that was accessed or modified |
See the ItemType table for details on the types of objects
. |
EVENTSOURCE |
Based on EventSource, where this field contains the contains the details that identifies that an event occurred in SharePoint. |
SOURCENAME |
Based on SourceName, where this field indicates the entity that triggered the audited operation. |
USERAGENT |
Based on UserAgent, where this field contains the information about the user's |
This information is provided by the
client or browser. |
MACHINEDOMAININFO |
Based on MachineDomainInfo, where this field contains the information about device sync operations. |
MACHINEID |
Based on MachineId, where this field contains the information about device sync operations |
This information is reported only if it's present in the request
APPDISPLAYNAME
. |
APPACCESSCTX |
AppAccessContext - Field that contains sub-fields:
ClientAppId
ClientAppName
CorrelationId
AADSessionId
Based on AppAccessContext, where this field is a structure that contains information such as: ClientAppId, ClientAppName, CorrelationId and AADSessionId. | |
APPDISPLAYNAME | Based on ApplicationDisplayName, there’s no available documentation for this field. |
APPID |
Based on ApplicationId, there’s no available documentation for this field. |
CORRELATIONID |
Based on CorrelationId, there’s no available documentation for this field. |