Microsoft Defender for Identity Modeling Rule

Modeling Rule

Microsoft Defender for Identity

Details

IDMicrosoft_Defender_for_Identity_ModelingRule
From Version6.10.0

Schema

microsoft_azure_atp_raw

Field Type Array?
app string —
cefDeviceEventClassId string —
cefDeviceVersion string —
cefSeverity string —
cs1 string —
cs2 string —
cs3 string —
externalId string —
msg string —
request string —
shost string —
suser string —

Source

MicrosoftDefenderforIdentity.xif MicrosoftDefenderforIdentity.yml MicrosoftDefenderforIdentity_schema.json
Download History Raw 
fromversion: 6.10.0
id: Microsoft_Defender_for_Identity_ModelingRule
name: Microsoft Defender for Identity Modeling Rule
rules: ''
schema: ''
tags: ''
supportedModules:
- xsiam