UCUpdateAlert

  • Article

Update Compliance - Alert for both Client and Service Update, will contain information that needs attention, relative to one device (client), one update, and one deployment (if relevant). Certain fields may be blank depending on the UpdateAlert's AlertType field; for example, ServiceUpdateAlert will not necessarily contain client-side statuses.

Table attributes

Attribute Value
Resource types -
Categories -
Solutions LogManagement, WaaSUpdateInsights
Basic log No
Ingestion-time transformation Yes
Sample Queries -

Columns

Column Type Description
AlertClassification string Whether this Alert is an Error, a Warning, or Informational.
AlertData string An optional string formatted as a json payload containing metadata for the alert.
AlertId string The unique identifier of this Alert.
AlertRank int Integer ranking of Alert for prioritization during troubleshooting.
AlertStatus string Whether this Alert is Active, Resolved, or Deleted.
AlertSubtype string The Subtype of Alert.
AlertType string The type of Alert this is, ClientUpdateAlert, ServiceUpdateAlert. Indicates which fields will be present.
AzureADDeviceId string A GUID corresponding to the AAD Tenant to which the device belongs.
AzureADTenantId string A GUID corresponding to this device's AAD Device ID.
_BilledSize real The record size in bytes
CatalogId string The update catalog ID.
ClientSubstate string If the Alert is from the Client, the ClientSubstate at the time thie Alert was activated or updated, else Empty.
ClientSubstateRank int Rank of ClientSubstate.
DeploymentId string The identifier of the Deployment that is targeting this update to this device, else empty.
Description string A localized string translated from a combination of other Alert fields + language preference that describes the issue in detail.
DeviceName string Device's given name.
ErrorCode string The Error Code, if any, that triggered this Alert. In the case of Client-based explicit alerts, error codes can have extended error codes, which are appended to the error code with a underscore separator.
ErrorSymName string The symbolic name that maps to the Error Code, if any. Otherwise empty.
GlobalDeviceId string Microsoft internal Global Device Identifier.
_IsBillable string Specifies whether ingesting the data is billable. When _IsBillable is false ingestion isn't billed to your Azure account
Recommendation string A localized string translated from RecommendedAction, Message, and other fields (depending on source of Alert) that provides a recommended action.
ResolvedTime datetime The time this alert was resolved, else empty.
SCCMClientId string A GUID corresponding to the SCCM Client ID on the device.
ServiceSubstate string Ranking of Client Substates for sequential ordering in funnel-type views. The rankings between ServiceSubstate and ClientSubstate can be used together.
ServiceSubstateRank int Rank of ServiceSubstate
SourceSystem string The type of agent the event was collected by. For example, OpsManager for Windows agent, either direct connect or Operations Manager, Linux for all Linux agents, or Azure for Azure Diagnostics
StartTime datetime The time this alert was activated.
TargetBuild string The full build of the content this DeviceUpdateEvent is tracking. For Windows 10 updates, this would correspond to the full build (10.0.14393.385).
TargetVersion string The target OS Version - eg, 1909.
TenantId string The Log Analytics workspace ID
TimeGenerated datetime Time at which this event is generated.
Type string The name of the table
UpdateCategory string The type of content this DeviceUpdateEvent is tracking.
UpdateClassification string Whether this content is an Upgrade (FU), Security (QU), NonSecurity (QU)
UpdateId string Update ID of the targeted update.
URL string An optional URL to get more in-depth information related to this alert.