Defender For Cloud Microsoft Modeling Rule

Modeling Rule

Microsoft Defender for Cloud

Details

IDdefender_for_cloud_microsoft_modeling_rule
From Version6.10.0
Tagsdefender_for_cloud

Schema

microsoft_defender_for_cloud_raw

Field Type Array?
AgentId string
AlertDisplayName string
AlertName string
AlertSeverity string
AlertType string
CorrelationKey string
Description string
DestinationDeviceAddress string
Entities string
ExtendedProperties string
ProductComponentName string
ProductName string
ProviderName string
ResourceIdentifiers string
Severity string
SourceDeviceAddress string
SystemAlertId string
Tactics string
Techniques string
TimeGenerated string
VendorOriginalId string
_collector_type string
id string
name string
properties string
type string
{
  "microsoft_defender_for_cloud_raw": {
    "id": {
      "type": "string",
      "is_array": false
    },
    "name": {
      "type": "string",
      "is_array": false
    },
    "properties": {
      "type": "string",
      "is_array": false
    },
    "type": {
      "type": "string",
      "is_array": false
    },
    "_collector_type": {
      "type": "string",
      "is_array": false
    },
    "Entities": {
      "type": "string",
      "is_array": false
    },
    "ResourceIdentifiers": {
      "type": "string",
      "is_array": false
    },
    "ExtendedProperties": {
      "type": "string",
      "is_array": false
    },
    "AgentId": {
      "type": "string",
      "is_array": false
    },
    "AlertDisplayName": {
      "type": "string",
      "is_array": false
    },
    "AlertType": {
      "type": "string",
      "is_array": false
    },
    "CorrelationKey": {
      "type": "string",
      "is_array": false
    },
    "Description": {
      "type": "string",
      "is_array": false
    },
    "Severity": {
      "type": "string",
      "is_array": false
    },
    "SystemAlertId": {
      "type": "string",
      "is_array": false
    },
    "ProductName": {
      "type": "string",
      "is_array": false
    },
    "ProductComponentName": {
      "type": "string",
      "is_array": false
    },
    "AlertSeverity": {
      "type": "string",
      "is_array": false
    },
    "Tactics": {
      "type": "string",
      "is_array": false
    },
    "Techniques": {
      "type": "string",
      "is_array": false
    },
    "DestinationDeviceAddress": {
      "type": "string",
      "is_array": false
    },
    "ProviderName": {
      "type": "string",
      "is_array": false
    },
    "AlertName": {
      "type": "string",
      "is_array": false
    },
    "SourceDeviceAddress": {
      "type": "string",
      "is_array": false
    },
    "VendorOriginalId": {
      "type": "string",
      "is_array": false
    },
    "TimeGenerated": {
      "type": "string",
      "is_array": false
    }
  }
}