|
|
|
@ -25,60 +25,37 @@ Alert for both client and service updates. Contains information that needs atten
|
|
|
|
|
|
|
|
|
|
|Field |Type |Example |Description |
|
|
|
|
|
|---|---|---|---|
|
|
|
|
|
| **AzureADDeviceId** | [string](/azure/kusto/query/scalar-data-types/string) | `71db1a1a-f1a6-4a25-b88f-79c2f513dae0` | Azure AD Device ID |
|
|
|
|
|
| **AzureADTenantId** | [string](/azure/kusto/query/scalar-data-types/string) | `69ca04b0-703d-4b3a-9184-c4e3c15d6f5e` | Azure AD Tenant ID |
|
|
|
|
|
| **City** | [string](/azure/kusto/query/scalar-data-types/string) | `Redmond` | The last-reported location of device (city), based on IP address. |
|
|
|
|
|
| **Country** | [string](/azure/kusto/query/scalar-data-types/string) | `US` | The last-reported location of device (country), based on IP address. Shown as country code. |
|
|
|
|
|
| **DeviceFamily** | [string](/azure/kusto/query/scalar-data-types/string) | `PC, Phone` | The device family such as PC, Phone |
|
|
|
|
|
| **DeviceFormFactor** | [string](/azure/kusto/query/scalar-data-types/string) | `Notebook` | The device form factor such as Notebook, Desktop, Phone |
|
|
|
|
|
| **DeviceManufacturer** | [string](/azure/kusto/query/scalar-data-types/string) | `Hewlett-Packard` | The device OEM Manufacturer such as Hewlett-Packard |
|
|
|
|
|
| **DeviceModel** | [string](/azure/kusto/query/scalar-data-types/string) | `HP7420 Workstation` | The device's OEM model such as HP7420 Workstation |
|
|
|
|
|
| **DeviceName** | [string](/azure/kusto/query/scalar-data-types/string) | `JohnPC-Contoso` | Client-provided device name |
|
|
|
|
|
| **GlobalDeviceId** | [string](/azure/kusto/query/scalar-data-types/string) | `g:9832741921341` | The global device identifier. |
|
|
|
|
|
| **IsVirtual** | [bool](/azure/kusto/query/scalar-data-types/bool) | `TRUE` | Whether device is a Virtual Device |
|
|
|
|
|
| **LastCensusScanTime** | [datetime](/azure/kusto/query/scalar-data-types/datetime) | `2020-05-14 09:26:03.478039` | The last time this device performed a successful Census Scan, if any. |
|
|
|
|
|
| **LastWUScanTime** | [datetime](/azure/kusto/query/scalar-data-types/datetime) | `2020-05-14 09:26:03.478039` | The last time this device performed a successful WU Scan, if any. |
|
|
|
|
|
| **OSArchitecture** | [string](/azure/kusto/query/scalar-data-types/string) | `x86` | The architecture of the OS (not the device) this device is currently on. |
|
|
|
|
|
| **OSBuild** | [string](/azure/kusto/query/scalar-data-types/string) | `10.0.18363.836` | The full OS build installed on this device, for example, Major.Minor.Build.Revision |
|
|
|
|
|
| **OSBuildNumber** | [int](/azure/kusto/query/scalar-data-types/int) | `da` | The Major, in int format, this device is on |
|
|
|
|
|
| **OSEdition** | [string](/azure/kusto/query/scalar-data-types/string) | `Professional` | The Windows SKU/Edition |
|
|
|
|
|
| **OSFeatureUpdateComplianceStatus** | [string](/azure/kusto/query/scalar-data-types/string) | `Compliant` | Whether or not the device is on the latest Feature Update being Offered by WUfB DS, else NotApplicable. |
|
|
|
|
|
| **OSFeatureUpdateEOSTime** | [datetime](/azure/kusto/query/scalar-data-types/datetime) | `2020-05-14 09:26:03.478039` | The end of service date of the Feature Update currently installed on the device. |
|
|
|
|
|
| **OSFeatureUpdateReleaseTime** | [datetime](/azure/kusto/query/scalar-data-types/datetime) | `2020-05-14 09:26:03.478039` | The release date of the Feature Update currently installed on the device. |
|
|
|
|
|
| **OSFeatureUpdateStatus** | [string](/azure/kusto/query/scalar-data-types/string) | `InService;EndOfService` | Whether or not the device is on the latest available Feature Update, for its Feature Update. |
|
|
|
|
|
| **OSQualityUpdateComplianceStatus** | [string](/azure/kusto/query/scalar-data-types/string) | `NotCompliant` | Whether or not the device is on the latest Quality Update being Offered by WUfB DS, else NotApplicable. |
|
|
|
|
|
| **OSQualityUpdateReleaseTime** | [datetime](/azure/kusto/query/scalar-data-types/datetime) | `2020-05-14 09:26:03.478039` | The release date of the Quality Update currently installed on the device. |
|
|
|
|
|
| **OSQualityUpdateStatus** | [string](/azure/kusto/query/scalar-data-types/string) | `Latest;NotLatest` | Whether or not the device is on the latest available Quality Update, for its Feature Update. |
|
|
|
|
|
| **OSRevisionNumber** | [int](/azure/kusto/query/scalar-data-types/int) | `836` | The revision, in int format, this device is on. |
|
|
|
|
|
| **OSSecurityUpdateComplianceStatus** | [string](/azure/kusto/query/scalar-data-types/string) | `NotCompliant` | Whether or not the device is on the latest Security update (QU, Classification=Security) being offered by WUfB DS, else NotApplicable. |
|
|
|
|
|
| **OSSecurityUpdateStatus** | [string](/azure/kusto/query/scalar-data-types/string) | `Latest;NotLatest;MultipleSecurityUpdatesMissing` | Whether or not the device is on the latest available Security Update, for its Feature Update. |
|
|
|
|
|
| **OSServicingChannel** | [string](/azure/kusto/query/scalar-data-types/string) | `SAC` | The elected Windows 10 Servicing Channel of the device. |
|
|
|
|
|
| **OSVersion** | [string](/azure/kusto/query/scalar-data-types/string) | `1909` | The Win10 OS Version (such as 19H2, 20H1, 20H2) currently installed on the device. |
|
|
|
|
|
| **PrimaryDiskFreeCapacityMb** | [int](/azure/kusto/query/scalar-data-types/int) | `1132` | Free disk capacity of the primary disk in megabytes. |
|
|
|
|
|
| **SCCMClientId** | [string](/azure/kusto/query/scalar-data-types/string) | `5AB72FAC-93AB-4954-9AB0-6557D0EFA245` | Configuration Manager Client ID, if available. |
|
|
|
|
|
| **AlertClassification** | [string](/azure/kusto/query/scalar-data-types/string) | `Error` | Whether this Alert is an Error, a Warning, or Informational. |
|
|
|
|
|
| **AlertData** | [string](/azure/kusto/query/scalar-data-types/string) {json} | `{ "freeDiskCapacityMb": 3213, "contentSizeMb": 4381}` | An optional string formatted as a json payload containing metadata for the alert. |
|
|
|
|
|
| **AlertId** | [string](/azure/kusto/query/scalar-data-types/string) | `9e107d9d372bb6826bd81d3542a419d6` | The unique identifier of this Alert. |
|
|
|
|
|
| **AlertRank** | [int](/azure/kusto/query/scalar-data-types/int) | `1000` | Integer ranking of Alert for prioritization during troubleshooting |
|
|
|
|
|
| **AlertStatus** | [string](/azure/kusto/query/scalar-data-types/string) | `Active` | Whether this Alert is Active, Resolved, or Deleted. |
|
|
|
|
|
| **AlertSubtype** | [string](/azure/kusto/query/scalar-data-types/string) | `DiskFull` | The Subtype of Alert. |
|
|
|
|
|
| **AlertType** | [string](/azure/kusto/query/scalar-data-types/string) | `ClientUpdateAlert` | The type of Alert such as ClientUpdateAlert or ServiceUpdateAlert. Indicates which fields will be present. |
|
|
|
|
|
| **AzureADDeviceId** | [string](/azure/kusto/query/scalar-data-types/string) | `71db1a1a-f1a6-4a25-b88f-79c2f513dae0` | Azure AD Device ID of the device, if available. |
|
|
|
|
|
| **AzureADTenantId** | [string](/azure/kusto/query/scalar-data-types/string) | `69ca04b0-703d-4b3a-9184-c4e3c15d6f5e` | Azure AD Tenant ID of the device. |
|
|
|
|
|
| **ClientSubstate** | [string](/azure/kusto/query/scalar-data-types/string) | `DownloadStart` | If the Alert is from the Client, the ClientSubstate at the time this Alert was activated or updated, else Empty. |
|
|
|
|
|
| **ClientSubstateRank** | [int](/azure/kusto/query/scalar-data-types/int) | `2300` | Rank of ClientSubstate |
|
|
|
|
|
| **DeploymentId** | [string](/azure/kusto/query/scalar-data-types/string) | `cf1b12a3-3d84-4ce3-bc8e-de48459e252d` | The Deployment this Alert is relative to, if there's one. |
|
|
|
|
|
| **Description** | [string](/azure/kusto/query/scalar-data-types/string) | `Disk full` | A localized string translated from a combination of other Alert fields + language preference that describes the issue in detail. |
|
|
|
|
|
| **DeviceName** | [string](/azure/kusto/query/scalar-data-types/string) | `JohnPC-Contoso` | The given device's name |
|
|
|
|
|
| **ErrorCode** | [string](/azure/kusto/query/scalar-data-types/string) | `0x8326CFA2D_C3FD` | The Error Code, if any, that triggered this Alert. In the case of Client-based explicit alerts, error codes can have extended error codes, which are appended to the error code with an underscore separator. |
|
|
|
|
|
| **ErrorSymName** | [string](/azure/kusto/query/scalar-data-types/string) | `WU_E_DISK_FULL` | The symbolic name that maps to the Error Code, if any. Otherwise empty. |
|
|
|
|
|
| **GlobalDeviceId** | [string](/azure/kusto/query/scalar-data-types/string) | `g:1298371934870` | Internal Microsoft Global identifier, if available. |
|
|
|
|
|
| **Recommendation** | [string](/azure/kusto/query/scalar-data-types/string) | `Free up disk space.` | A localized string translated from RecommendedAction, Message, and other fields (depending on source of Alert) that provides a recommended action. |
|
|
|
|
|
| **ResolvedTime** | [datetime](/azure/kusto/query/scalar-data-types/datetime) | `2020-05-14 09:26:03.478039` | The time this alert was resolved, else empty. |
|
|
|
|
|
| **SCCMClientId** | [string](/azure/kusto/query/scalar-data-types/string) | `5AB72FAC-93AB-4954-9AB0-6557D0EFA245` | SCCM Client ID of the device, if available. |
|
|
|
|
|
| **ServiceSubstate** | [string](/azure/kusto/query/scalar-data-types/string) | `OfferReady` | If the Alert is from the Service, the ServiceSubstate at the time this Alert was activated or updated, else Empty. |
|
|
|
|
|
| **ServiceSubstateRank** | [int](/azure/kusto/query/scalar-data-types/int) | `100` | Rank of ServiceSubstate |
|
|
|
|
|
| **StartTime** | [datetime](/azure/kusto/query/scalar-data-types/datetime) | `2020-05-14 09:26:03.478039` | The time this alert was activated. |
|
|
|
|
|
| **TargetBuild** | [string](/azure/kusto/query/scalar-data-types/string) | `18363.836` | The Windows 10 Major.Revision this UpdateAlert is relative to. |
|
|
|
|
|
| **TargetVersion** | [string](/azure/kusto/query/scalar-data-types/string) | `1909` | The Windows 10 Build this UpdateAlert is relative to. |
|
|
|
|
|
| **TimeGenerated** | [datetime](/azure/kusto/query/scalar-data-types/datetime) | `2020-05-14 09:26:03.478039` | The time the snapshot generated this specific record. This is to determine to which batch snapshot this record belongs. |
|
|
|
|
|
| **Type** | [string](/azure/kusto/query/scalar-data-types/string) | `DeviceEvent` | The EntityType. |
|
|
|
|
|
| **UpdateConnectivityLevel** | [string](/azure/kusto/query/scalar-data-types/string) | `Insufficient` | Whether or not this device is maintaining a sufficiently cumulative and continuous connection to Windows Update so the update can progress optimally. |
|
|
|
|
|
| **WUAutomaticUpdates** | [int](/azure/kusto/query/scalar-data-types/int) | `5` | CSP: AllowAutoUpdate &'AuOptions' Enables the IT admin to manage automatic update behavior to scan, download, and install updates. |
|
|
|
|
|
| **WUDeadlineNoAutoRestart** | [int](/azure/kusto/query/scalar-data-types/int) | `1` | CSP:ConfigureDeadlineNoAutoReboot. Devices won't automatically restart outside of active hours until the deadline is reached, 1 is Enabled, 0 is Disabled (default) |
|
|
|
|
|
| **WUDODownloadMode** | [string](/azure/kusto/query/scalar-data-types/string) | `Simple (99)` | The WU DO DownloadMode configuration, brought over from Update Compliance. |
|
|
|
|
|
| **WUFeatureDeadlineDays** | [int](/azure/kusto/query/scalar-data-types/int) | `0` | CSP: ConfigureDeadlineForFeatureUpdatesThe WU Feature Update deadline configuration in days. -1 indicates not configured, 0 indicates configured but set to 0. Values greater than 0 indicate the deadline in days. |
|
|
|
|
|
| **WUFeatureDeferralDays** | [int](/azure/kusto/query/scalar-data-types/int) | `0` | CSP: DeferFeatureUpdates. The WU Feature Update Deferral configuration in days. -1 indicates not configured, 0 indicates configured but set to 0. Values >0 indicate the policy setting. |
|
|
|
|
|
| **WUFeatureGracePeriodDays** | [int](/azure/kusto/query/scalar-data-types/int) | `7` | The WU grace period for feature update in days. -1 indicates not configured, 0 indicates configured and set to 0. Values greater than 0 indicate the Grace Period in days. |
|
|
|
|
|
| **WUFeaturePauseEndTime** | [datetime](/azure/kusto/query/scalar-data-types/datetime) | `2020-05-14 09:26:03.478039` | CSP:PauseQualityUpdatesEndTimeThe time WU Feature Update Pause will end, if activated, else null. |
|
|
|
|
|
| **WUFeaturePauseStartTime** | [datetime](/azure/kusto/query/scalar-data-types/datetime) | `2020-05-14 09:26:03.478039` | CSP: PauseFeatureUpdatesStartTime. The time WU Feature Update Pause was activated, if activated, else null. Feature Updates will be paused for 35 days from the specified start date. |
|
|
|
|
|
| **WUFeaturePauseState** | [string](/azure/kusto/query/scalar-data-types/string) | `NotConfigured` | Indicates pause status of device for FU, possible values are Paused, NotPaused, NotConfigured. |
|
|
|
|
|
| **WUNotificationLevel** | [int](/azure/kusto/query/scalar-data-types/int) | `0` | CSP: UpdateNotificationLevel. This policy allows you to define what Windows Update notifications users see. </br> 0 - Use the default Windows Update notifications (default) </br> 1 - Turn off all notifications, excluding restart warnings </br> 2 - Turn off all notifications, including restart warnings |
|
|
|
|
|
| **WUPauseUXDisabled** | [int](/azure/kusto/query/scalar-data-types/int) | `0` | CSP: SetDisablePauseUXAccess. This policy allows the IT admin to disable the "Pause Updates" feature. When this policy is enabled, the user can't access the "Pause updates" feature. Supported values 0, 1. |
|
|
|
|
|
| **WUQualityDeadlineDays** | [int](/azure/kusto/query/scalar-data-types/int) | `7` | CSP: ConfigureDeadlineForQualityUpdates The WU Quality Update deadline configuration in days. -1 indicates not configured, 0 indicates configured but set to 0. Values >0 indicate the deadline in days. |
|
|
|
|
|
| **WUQualityDeferralDays** | [int](/azure/kusto/query/scalar-data-types/int) | `-1` | CSP: DeferQualityUpdatesThe WU Quality Update Deferral configuration in days. -1 indicates not configured, 0 indicates configured but set to 0. Values >0 indicate the policy setting. |
|
|
|
|
|
| **WUQualityGracePeriodDays** | [int](/azure/kusto/query/scalar-data-types/int) | `0` | The WU grace period for quality update in days. -1 indicates not configured, 0 indicates configured and set to 0. Values greater than 0 indicate the Grace Period in days. |
|
|
|
|
|
| **WUQualityPauseEndTime** | [datetime](/azure/kusto/query/scalar-data-types/datetime) | `2020-05-14 09:26:03.478039` | CSP:PauseQualityUpdatesEndTimeThe time WU Quality Update Pause will end, if activated, else null. |
|
|
|
|
|
| **WUQualityPauseStartTime** | [datetime](/azure/kusto/query/scalar-data-types/datetime) | `2020-05-14 09:26:03.478039` | CSP:PauseQualityUpdatesStartTime The time WU Quality Update Pause was activated; if activated; else null. |
|
|
|
|
|
| **WUQualityPauseState** | [string](/azure/kusto/query/scalar-data-types/string) | `NotConfigured` | Indicates pause status of device for QU, possible values are Paused, NotPaused, NotConfigured. |
|
|
|
|
|
| **WURestartNotification** | [int](/azure/kusto/query/scalar-data-types/int) | `1` | CSP: AutoRestartRequiredNotificationDismissal. Allows the IT Admin to specify the method by which the auto-restart required notification is dismissed. The following list shows the supported values: </br> 1 is Auto Dismissal. (default) </br> 2 is User Dismissal. |
|
|
|
|
|
| **WUServiceURLConfigured** | [string](/azure/kusto/query/scalar-data-types/string) | `http://abcd-srv:8530` | CSP:UpdateServiceUrl. The following list shows the supported values: </br> </br> Not configured. The device checks for updates from Microsoft Update. </br> </br> Set to a URL, such as `http://abcd-srv:8530`, the device checks for updates from the WSUS server at the specified URL.|
|
|
|
|
|
| **WUUXDisabled** | [int](/azure/kusto/query/scalar-data-types/int) | `1` | CSP:SetDisableUXWUAccess.This policy allows the IT admin to remove access to scan Windows Update. When this policy is enabled, the user can't access the Windows Update scan, download, and install features. Default is 0. Supported values 0, 1. |
|
|
|
|
|
| **Type** | [string](/azure/kusto/query/scalar-data-types/string) | `UpdateAlert` | The entity type. |
|
|
|
|
|
| **UpdateCategory** | [string](/azure/kusto/query/scalar-data-types/string) | `WindowsFeatureUpdate` | The type of content this DeviceUpdateEvent is tracking. |
|
|
|
|
|
| **UpdateClassification** | [string](/azure/kusto/query/scalar-data-types/string) | `Upgrade` | Whether this content is an Upgrade (FU), Security (QU), NonSecurity (QU) |
|
|
|
|
|
| **URL** | [string](/azure/kusto/query/scalar-data-types/string) | `aka.ms/errordetail32152` | An optional URL to get more in-depth information related to this alert. |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
## Next steps
|
|
|
|
|
|
|
|
|
|