Microsoft Advanced Threat Analytics Modeling Rule

Details

ID	`Microsoft_Advanced_Threat_Analytics_ModelingRule`
From Version	6.10.0

Rules (XIF)

[MODEL: dataset="microsoft_ata_raw"]
alter
    xdm.network.application_protocol = app, 
    xdm.event.description = msg,
    xdm.source.host.hostname = shost, 
    xdm.source.user.username = suser,
    xdm.event.id = externalId,
    xdm.alert.severity = cefSeverity,
    xdm.observer.version = cefDeviceVersion,
    xdm.alert.subcategory = cefDeviceEventClassId,
    xdm.intermediate.host.fqdn = cs1,
    xdm.target.host.fqdn = request;

Schema

`microsoft_ata_raw`

Field	Type	Array?
`app`	string	—
`cefDeviceEventClassId`	string	—
`cefDeviceProduct`	string	—
`cefDeviceVendor`	string	—
`cefDeviceVersion`	string	—
`cefName`	string	—
`cefSeverity`	string	—
`cs1`	string	—
`cs1Label`	string	—
`externalId`	string	—
`msg`	string	—
`request`	string	—
`shost`	string	—
`suser`	string	—

Raw JSON

{
    "microsoft_ata_raw": {
      "app": {
          "type": "string",
          "is_array": false
      },
      "msg": {
          "type": "string",
          "is_array": false
      },
      "shost": {
          "type": "string",
          "is_array": false
      },
      "suser": {
        "type": "string",
        "is_array": false
      },
      "cefName": {
          "type": "string",
          "is_array": false
      },
      "externalId": {
          "type": "string",
          "is_array": false
      },
      "cefSeverity": {
          "type": "string",
          "is_array": false
      },
      "cefDeviceVendor": {
        "type": "string",
        "is_array": false
      },
      "cefDeviceProduct": {
        "type": "string",
        "is_array": false
      },
      "cefDeviceVersion": {
        "type": "string",
        "is_array": false
      },
      "cefDeviceEventClassId": {
        "type": "string",
        "is_array": false
      },
      "cs1": {
        "type": "string",
        "is_array": false
      },
      "cs1Label": {
        "type": "string",
        "is_array": false
      },
      "request": {
        "type": "string",
        "is_array": false
      }
    }
  }