Microsoft 365 Defender Classification

Details

ID	`incident_microsoft365defenderclassification`
CLI Name	`microsoft365defenderclassification`
Type	singleSelect
Version	-1
Required	No
Read Only	No
Use as KPI	No
Searchable	Yes

Select Values

TruePositive - MultiStagedAttack
TruePositive - MaliciousUserActivity
TruePositive - Malware
TruePositive - Phishing
TruePositive - CompromisedAccount
TruePositive - UnwantedSoftware
TruePositive - Other
InformationalExpectedActivity - SecurityTesting
InformationalExpectedActivity - LineOfBusinessApplication
InformationalExpectedActivity - ConfirmedActivity
InformationalExpectedActivity - Other
FalsePositive - NotMalicious
FalsePositive - NoEnoughDataToValidate
FalsePositive - Other
Unknown - NotAvailable

Associated Incident Types

Microsoft 365 Defender Incident

Source

incidentfield-Microsoft_365_Defender_Classification.json

Download History Raw

{
    "associatedToAll": false,
    "associatedTypes": [
        "Microsoft 365 Defender Incident"
    ],
    "caseInsensitive": true,
    "cliName": "microsoft365defenderclassification",
    "closeForm": false,
    "content": true,
    "editForm": true,
    "group": 0,
    "hidden": false,
    "id": "incident_microsoft365defenderclassification",
    "isReadOnly": false,
    "locked": false,
    "name": "Microsoft 365 Defender Classification",
    "neverSetAsRequired": false,
    "ownerOnly": false,
    "required": false,
    "sla": 0,
    "system": false,
    "threshold": 72,
    "type": "singleSelect",
    "unmapped": false,
    "unsearchable": false,
    "useAsKpi": false,
    "version": -1,
    "fromVersion": "5.5.0",
    "selectValues": [
        "TruePositive - MultiStagedAttack",
        "TruePositive - MaliciousUserActivity",
        "TruePositive - Malware",
        "TruePositive - Phishing",
        "TruePositive - CompromisedAccount",
        "TruePositive - UnwantedSoftware",
        "TruePositive - Other",
        "InformationalExpectedActivity - SecurityTesting",
        "InformationalExpectedActivity - LineOfBusinessApplication",
        "InformationalExpectedActivity - ConfirmedActivity",
        "InformationalExpectedActivity - Other",
        "FalsePositive - NotMalicious",
        "FalsePositive - NoEnoughDataToValidate",
        "FalsePositive - Other",
        "Unknown - NotAvailable"
    ],
    "supportedModules": [
        "agentix",
        "xsiam"
    ]
}