Source types for the Splunk Add on for Microsoft Azure

The Splunk Add-on for Microsoft Azure provides the index-time and search-time knowledge for Microsoft Azure data in the following formats:

Data source	Default sourcetype(s)
Azure Active Directory Interactive Sign-ins	azure:aad:signin
Azure Active Directory Users	azure:aad:user
Azure Active Directory Groups	azure:aad:group
Azure Active Directory Audit	azure:aad:audit
Azure Active Directory Risk Detection	azure:aad:risk:detection
Azure Active Directory Devices	azure:aad:device
Metrics	azure:metrics
Security Center	azure:securityCenter:alert azure:securityCenter:task
Subscriptions	azure:subscriptions
Resource Groups	azure:resource:group
Virtual Networks	azure:vnet azure:vnet:nic azure:vnet:nsg azure:vnet:ip:public
Compute	azure:compute:vm azure:compute:disk azure:compute:image azure:compute:snapshot
Azure Billing and Consumption	azure:billing
Azure Reservation Recommendation	azure:reservation:recommendation
Azure Resource Graph	azure:resourcegraph
Azure Topology (automatic)	azure:topology
Azure Topology (manual)	azure:topology