Microsoft Graph Logs connector reference

Beta

This feature is in Beta. To use it, a workspace admin must turn on Lakeflow Connect for Microsoft Graph Logs from the Previews page. See Manage Databricks previews.

This page has reference information for the managed Microsoft Graph Logs connector, including supported source tables and destination table schemas.

Supported source tables

The Microsoft Graph Logs connector supports the following source table under the default source schema:

Source table	Primary key	Description	Sync mode	Cursor field
security_alerts	id	Security alerts from Microsoft security products, such as Microsoft Defender XDR and Microsoft Sentinel. See alert resource type.	Incremental	lastUpdateDateTime

Source table	Primary key	Description	Sync mode	Cursor field
security_alerts	id	Security alerts from Microsoft security products, such as Microsoft Defender XDR and Microsoft Sentinel. See alert resource type.	Incremental	lastUpdateDateTime

Connector options

The Microsoft Graph Logs connector has the following option. For usage, see the pipeline examples.

Option	Type	Scope	Required	Applies to	Description
start_datetime	string	Pipeline	No	All tables	The earliest lastUpdateDateTime to ingest on the first sync, in UTC (for example, 2026-01-01T00:00:00Z). If you don't set it, the first sync ingests alerts updated in the previous 180 days.

Option	Type	Scope	Required	Applies to	Description
start_datetime	string	Pipeline	No	All tables	The earliest lastUpdateDateTime to ingest on the first sync, in UTC (for example, 2026-01-01T00:00:00Z). If you don't set it, the first sync ingests alerts updated in the previous 180 days.

Destination table schemas

security_alerts

Primary key: id

Cursor field: lastUpdateDateTime

Field	Data type
id	STRING
title	STRING
category	STRING
categories	ARRAY<STRING>
severity	STRING
status	STRING
serviceSource	STRING
detectionSource	STRING
detectorId	STRING
productName	STRING
providerAlertId	STRING
incidentId	STRING
incidentWebUrl	STRING
alertWebUrl	STRING
alertPolicyId	STRING
tenantId	STRING
description	STRING
recommendedActions	STRING
investigationState	STRING
determination	STRING
classification	STRING
assignedTo	STRING
actorDisplayName	STRING
threatDisplayName	STRING
threatFamilyName	STRING
mitreTechniques	ARRAY<STRING>
systemTags	ARRAY<STRING>
createdDateTime	TIMESTAMP
lastUpdateDateTime	TIMESTAMP
firstActivityDateTime	TIMESTAMP
lastActivityDateTime	TIMESTAMP
resolvedDateTime	TIMESTAMP
comments	VARIANT
evidence	VARIANT
additionalData	VARIANT
customDetails	VARIANT

Field	Data type
id	STRING
title	STRING
category	STRING
categories	ARRAY<STRING>
severity	STRING
status	STRING
serviceSource	STRING
detectionSource	STRING
detectorId	STRING
productName	STRING
providerAlertId	STRING
incidentId	STRING
incidentWebUrl	STRING
alertWebUrl	STRING
alertPolicyId	STRING
tenantId	STRING
description	STRING
recommendedActions	STRING
investigationState	STRING
determination	STRING
classification	STRING
assignedTo	STRING
actorDisplayName	STRING
threatDisplayName	STRING
threatFamilyName	STRING
mitreTechniques	ARRAY<STRING>
systemTags	ARRAY<STRING>
createdDateTime	TIMESTAMP
lastUpdateDateTime	TIMESTAMP
firstActivityDateTime	TIMESTAMP
lastActivityDateTime	TIMESTAMP
resolvedDateTime	TIMESTAMP
comments	VARIANT
evidence	VARIANT
additionalData	VARIANT
customDetails	VARIANT

note

This table does not support SCD Type 2 because it has VARIANT columns.

Required OAuth permissions

The Microsoft Entra ID application that the connection uses must have the following Microsoft Graph application permission, with admin consent granted. See the Microsoft Graph permissions reference.

Permission	Required for
SecurityAlert.Read.All (Application)	security_alerts

Permission	Required for
SecurityAlert.Read.All (Application)	security_alerts