title: Azure Activity Logs Elasticsearch ecs mapping
order: 20
backends:
  - es-qs
  - es-rule
fieldmappings:
  claims.name: user.name
  properties.message: event.action
  properties.eventCategory: azure.activitylogs.event_category
  status.value: event.outcome
  resourceType.value: azure.resource.provider
