Microsoft Advanced Threat Analytics - Incoming Mapper

Maps Microsoft Advanced Threat Analytics suspicious activity fields.

Microsoft Advanced Threat Analytics Mapper (In)

Details

ID	`Microsoft Advanced Threat Analytics-mapper`
Type	mapping-incoming
Version	-1
From Version	6.0.0
Default Incident Type	Microsoft ATA Suspicious Activity
Feed	No

Source

classifier-mapper-incoming-MicrosoftAdvancedThreatAnalytics.json

Download History Raw

{
	"id": "Microsoft Advanced Threat Analytics-mapper",
	"name": "Microsoft Advanced Threat Analytics - Incoming Mapper",
	"type": "mapping-incoming",
	"description": "Maps Microsoft Advanced Threat Analytics suspicious activity fields.",
	"fromVersion": "6.0.0",
	"version": -1,
	"defaultIncidentType": "Microsoft ATA Suspicious Activity",
	"feed": false,
	"mapping": {
		"Microsoft ATA Suspicious Activity": {
			"dontMapEventToLabels": false,
			"internalMapping": {
				"Src Hostname": {
					"complex": null,
					"simple": "SourceComputerIds"
				},
				"Suspicious Activity End Time": {
					"complex": null,
					"simple": "EndTime"
				},
				"Suspicious Activity ID": {
					"complex": null,
					"simple": "Id"
				},
				"Suspicious Activity Severity": {
					"complex": null,
					"simple": "Severity"
				},
				"Suspicious Activity Start Time": {
					"complex": null,
					"simple": "StartTime"
				},
				"Suspicious Activity Status": {
					"complex": null,
					"simple": "Status"
				}
			}
		},
		"dbot_classification_incident_type_all": {
			"dontMapEventToLabels": true,
			"internalMapping": {
				"Event ID": {
					"complex": null,
					"simple": "WindowsEventId"
				},
				"details": {
					"complex": null,
					"simple": "DescriptionFormatKey"
				}
			}
		}
	}
}