Microsoft Defender for Identity Modeling Rule

Details

ID	`Microsoft_Defender_for_Identity_ModelingRule`
From Version	6.10.0

Schema

`microsoft_azure_atp_raw`

Field	Type	Array?
`app`	string	—
`cefDeviceEventClassId`	string	—
`cefDeviceVersion`	string	—
`cefSeverity`	string	—
`cs1`	string	—
`cs2`	string	—
`cs3`	string	—
`externalId`	string	—
`msg`	string	—
`request`	string	—
`shost`	string	—
`suser`	string	—

Source

MicrosoftDefenderforIdentity.xif MicrosoftDefenderforIdentity.yml MicrosoftDefenderforIdentity_schema.json

Download History Raw

{
    "microsoft_azure_atp_raw": {
      "app": {
        "type": "string",
        "is_array": false
      },
      "cs1": {
        "type": "string",
        "is_array": false
      },
      "msg": {
        "type": "string",
        "is_array": false
      },
      "shost": {
        "type": "string",
        "is_array": false
      },
      "suser": {
        "type": "string",
        "is_array": false
      },
      "request": {
        "type": "string",
        "is_array": false
      },
      "externalId": {
        "type": "string",
        "is_array": false
      },
      "cefSeverity": {
        "type": "string",
        "is_array": false
      },
      "cefDeviceVersion": {
        "type": "string",
        "is_array": false
      },
      "cefDeviceEventClassId": {
        "type": "string",
        "is_array": false
      },
      "cs2": {
        "type": "string",
        "is_array": false
      },
      "cs3": {
        "type": "string",
        "is_array": false
      }
    }
  }