AgentsInfo

AgentsInfo table in the advanced hunting schema contains information about AI agents and their associated entities.

Table attributes

Attribute Value
Resource types -
Categories Security
Solutions SecurityInsights
Basic log No
Ingestion-time DCR support No
Lake-only ingestion Yes
Sample Queries Yes

Columns

Column Type Description
AgentId string Unique identifier for the agent
Availability string The deployment scope of the agent (that is, whether deployed to all users, specific groups, or individual users).
_BilledSize real The record size in bytes
Capabilities dynamic The intents, actions, skills, and orchestrations of the agent.
Channels dynamic The channels or surfaces where the agent can operate, such as Microsoft 365 applications or APIs.
ConnectedAgents dynamic List of other agents connected to the agent for multi-agent orchestration.
CreatedDateTime datetime Date and time when the agent was created.
DeclaredDataSources dynamic The data repositories and knowledge sources the agent can access.
DeclaredTools dynamic Functional tools the agent can invoke at runtime.
Description string Description of the agent as displayed in the agent's source.
Endpoints dynamic List of agent runtime endpoints, including URL, transport type, and external connectivity flag.
EntraAgentID string The agent's unique enterprise application object identifier by Microsoft Entra ID
EntraBlueprintID string The unique identifier by Microsoft Entra ID for the agent identity blueprint, which serves as the template from which the agent's identity was created.
Guardrails dynamic Guardrails attached to the agent and their coverage.
InstanceCount int Number of agent instances created from the same Microsoft Entra ID agent identity blueprint.
Instructions string The agent's system prompt that defines its default behavior, persona, and operating boundaries.
_IsBillable string Specifies whether ingesting the data is billable. When _IsBillable is false ingestion isn't billed to your Azure account
LastPublishedDateTime datetime Date and time when the agent was last published or deployed.
LastUpdatedDateTime datetime Date and time when the agent's metadata was last modified.
LifecycleStatus string The agent's current operational state in the tenant; possible values: Active, Blocked, Uninstalled, Deleted.
McpServers dynamic The Model Context Protocol (MCP) servers connected to the agent, including server URLs and credential configuration.
Memory dynamic The agent's declarative memory store configuration.
Model string The AI model powering the agent.
Name string Display name of the agent.
ObservabilityID dynamic Unique identifier used to correlate the agent with its usage and activity data in Microsoft Agent 365.
Owners dynamic Primary owners of the agent.
Permissions dynamic Permissions record of the agent, including those that have been requested and granted, their approval state, and consent enumeration.
Platform string The platform that provided the information about the agent.
PublishedStatus string The agent's publications status: Draft, Published.
RawAgentInfo dynamic Additional information about the agent, in JSON format.
SharedWith dynamic The users and security groups the agent has been shared with.
Skills dynamic Skills attached to the agent.
SourceAgentId string Native identifier assigned by the platform where the agent originated.
SourceSystem string The type of agent the event was collected by. For example, OpsManager for Windows agent, either direct connect or Operations Manager, Linux for all Linux agents, or Azure for Azure Diagnostics
TenantId string The Log Analytics workspace ID
TimeGenerated datetime Date and time the event was recorded by the MDE agent on the endpoint.
Timestamp datetime Date and time the agent information was recorded.
ToolsAuthenticationType dynamic Structured summary of agent identity, authentication, and authorization model.
Triggers dynamic List of the agent's triggers.
Type string The name of the table
Version string Version of the agent.
  • Last updated on