Microsoft Defender for Identity Modeling Rule

Details

ID	`Microsoft_Defender_for_Identity_ModelingRule`
From Version	6.10.0

Schema

`microsoft_azure_atp_raw`

Field	Type	Array?
`app`	string	—
`cefDeviceEventClassId`	string	—
`cefDeviceVersion`	string	—
`cefSeverity`	string	—
`cs1`	string	—
`cs2`	string	—
`cs3`	string	—
`externalId`	string	—
`msg`	string	—
`request`	string	—
`shost`	string	—
`suser`	string	—

Source

MicrosoftDefenderforIdentity.xif MicrosoftDefenderforIdentity.yml MicrosoftDefenderforIdentity_schema.json

Download History Raw

[MODEL: dataset="microsoft_azure_atp_raw"]
alter
	xdm.network.application_protocol = app,
	xdm.intermediate.host.fqdn = cs1,
	xdm.event.description = msg,
	xdm.source.host.hostname = shost,
	xdm.source.user.username = suser,
	xdm.target.host.fqdn = request,
	xdm.event.id = externalId,
	xdm.alert.severity = cefSeverity,
	xdm.observer.version = cefDeviceVersion,
	xdm.alert.subcategory = cefDeviceEventClassId;