Microsoft Advanced Threat Analytics Modeling Rule

Details

ID	`Microsoft_Advanced_Threat_Analytics_ModelingRule`
From Version	6.10.0

Schema

`microsoft_ata_raw`

Field	Type	Array?
`app`	string	—
`cefDeviceEventClassId`	string	—
`cefDeviceProduct`	string	—
`cefDeviceVendor`	string	—
`cefDeviceVersion`	string	—
`cefName`	string	—
`cefSeverity`	string	—
`cs1`	string	—
`cs1Label`	string	—
`externalId`	string	—
`msg`	string	—
`request`	string	—
`shost`	string	—
`suser`	string	—

Source

MicrosoftAdvancedThreatAnalytics.xif MicrosoftAdvancedThreatAnalytics.yml MicrosoftAdvancedThreatAnalytics_schema.json

Download History Raw

[MODEL: dataset="microsoft_ata_raw"]
alter
    xdm.network.application_protocol = app, 
    xdm.event.description = msg,
    xdm.source.host.hostname = shost, 
    xdm.source.user.username = suser,
    xdm.event.id = externalId,
    xdm.alert.severity = cefSeverity,
    xdm.observer.version = cefDeviceVersion,
    xdm.alert.subcategory = cefDeviceEventClassId,
    xdm.intermediate.host.fqdn = cs1,
    xdm.target.host.fqdn = request;