Microsoft Advanced Threat Analytics Modeling Rule

Modeling Rule

Details

ID	`Microsoft_Advanced_Threat_Analytics_ModelingRule`
From Version	6.10.0

Schema

`microsoft_ata_raw`

Field	Type	Array?
`app`	string	—
`cefDeviceEventClassId`	string	—
`cefDeviceProduct`	string	—
`cefDeviceVendor`	string	—
`cefDeviceVersion`	string	—
`cefName`	string	—
`cefSeverity`	string	—
`cs1`	string	—
`cs1Label`	string	—
`externalId`	string	—
`msg`	string	—
`request`	string	—
`shost`	string	—
`suser`	string	—

Source

MicrosoftAdvancedThreatAnalytics.xif MicrosoftAdvancedThreatAnalytics.yml MicrosoftAdvancedThreatAnalytics_schema.json

Download History Raw

fromversion: 6.10.0
id: Microsoft_Advanced_Threat_Analytics_ModelingRule
name: Microsoft Advanced Threat Analytics Modeling Rule
rules: ''
schema: ''
tags: ''
supportedModules:
- xsiam