Microsoft 365 Defender Event Collector Modeling Rule

Details

ID	`microsoft_365_defender_event_collector_ModelingRule`
From Version	6.10.0
Tags	Microsoft 365 Defender

Schema

`microsoft_365_defender_raw`

Field	Type	Array?
`alertCreationTime`	string	—
`category`	string	—
`computerDnsName`	string	—
`description`	string	—
`detectionSource`	string	—
`evidence`	string	—
`id`	string	—
`incidentId`	string	—
`lastEventTime`	string	—
`machineId`	string	—
`mitreTechniques`	string	—
`severity`	string	—
`threatFamilyName`	string	—
`threatName`	string	—
`title`	string	—

Source

Microsoft365DefenderEventCollector_1_3.xif Microsoft365DefenderEventCollector_1_3.yml Microsoft365DefenderEventCollector_1_3_schema.json

Download History Raw

fromversion: 6.10.0
id: microsoft_365_defender_event_collector_ModelingRule
name: Microsoft 365 Defender Event Collector Modeling Rule
rules: ''
schema: ''
tags: Microsoft 365 Defender
supportedModules:
- xsiam