Microsoft Defender for Identity Modeling Rule

Details

ID	`Microsoft_Defender_for_Identity_ModelingRule`
From Version	6.10.0

Rules (XIF)

[MODEL: dataset="microsoft_azure_atp_raw"]
alter
	xdm.network.application_protocol = app,
	xdm.intermediate.host.fqdn = cs1,
	xdm.event.description = msg,
	xdm.source.host.hostname = shost,
	xdm.source.user.username = suser,
	xdm.target.host.fqdn = request,
	xdm.event.id = externalId,
	xdm.alert.severity = cefSeverity,
	xdm.observer.version = cefDeviceVersion,
	xdm.alert.subcategory = cefDeviceEventClassId;

Schema

`microsoft_azure_atp_raw`

Field	Type	Array?
`app`	string	—
`cefDeviceEventClassId`	string	—
`cefDeviceVersion`	string	—
`cefSeverity`	string	—
`cs1`	string	—
`cs2`	string	—
`cs3`	string	—
`externalId`	string	—
`msg`	string	—
`request`	string	—
`shost`	string	—
`suser`	string	—

Raw JSON

{
    "microsoft_azure_atp_raw": {
      "app": {
        "type": "string",
        "is_array": false
      },
      "cs1": {
        "type": "string",
        "is_array": false
      },
      "msg": {
        "type": "string",
        "is_array": false
      },
      "shost": {
        "type": "string",
        "is_array": false
      },
      "suser": {
        "type": "string",
        "is_array": false
      },
      "request": {
        "type": "string",
        "is_array": false
      },
      "externalId": {
        "type": "string",
        "is_array": false
      },
      "cefSeverity": {
        "type": "string",
        "is_array": false
      },
      "cefDeviceVersion": {
        "type": "string",
        "is_array": false
      },
      "cefDeviceEventClassId": {
        "type": "string",
        "is_array": false
      },
      "cs2": {
        "type": "string",
        "is_array": false
      },
      "cs3": {
        "type": "string",
        "is_array": false
      }
    }
  }