Details
| ID | Office_365_ModelingRule |
|---|---|
| From Version | 8.15.0 |
Schema
msft_o365_general_raw
| Field | Type | Array? |
|---|---|---|
ActionId |
string | — |
Actions |
string | — |
ActorUserId |
string | — |
ActorYammerUserId |
int | — |
AlertEntityId |
string | — |
AlertId |
string | — |
AppAccessContext |
string | — |
Application |
string | — |
Category |
string | — |
ClientIP |
string | — |
Data |
string | — |
DataExportType |
string | — |
DeeplinkURL |
string | — |
Detail |
string | — |
Details |
string | — |
DetectionType |
string | — |
DeviceName |
string | — |
EnforcementMode |
int | — |
EntityId |
string | — |
EntityName |
string | — |
EntityType |
string | — |
EventDeepLink |
string | — |
ExtraProperties |
string | — |
Fields |
string | — |
FileData |
string | — |
FileExtension |
string | — |
FileName |
string | — |
FileSize |
int | — |
FileType |
string | — |
FormName |
string | — |
Id |
string | — |
InternetMessageId |
string | — |
InvestigationId |
string | — |
InvestigationName |
string | — |
InvestigationType |
string | — |
ItemId |
string | — |
ItemName |
string | — |
ItemType |
string | — |
Members |
string | — |
Message |
string | — |
MessageId |
string | — |
Messages |
string | — |
ModifiedProperties |
string | — |
Name |
string | — |
NetworkMessageId |
string | — |
ObjectId |
string | — |
Operation |
string | — |
OrganizationId |
string | — |
P1Sender |
string | — |
P2Sender |
string | — |
Platform |
string | — |
PolicyAction |
string | — |
PolicyMatchInfo |
string | — |
Reason |
string | — |
Recipients |
string | — |
RecordType |
int | — |
ReleaseTo |
string | — |
ResultStatus |
string | — |
Scope |
int | — |
SenderIp |
string | — |
Severity |
string | — |
Sha256 |
string | — |
Source |
string | — |
SourceApp |
string | — |
SourceWorkload |
int | — |
Status |
string | — |
Subject |
string | — |
TargetUserId |
string | — |
TargetYammerUserId |
int | — |
ThreatsAndDetectionTech |
string | — |
Url |
string | — |
UserAgent |
string | — |
UserId |
string | — |
UserIp |
string | — |
UserKey |
string | — |
UserName |
string | — |
UserRole |
string | — |
UserType |
int | — |
Verdict |
string | — |
Workload |
string | — |
msft_o365_exchange_online_raw
| Field | Type | Array? |
|---|---|---|
AffectedItems |
string | — |
AppAccessContext |
string | — |
AttachmentSizeInBytes |
int | — |
ClientApplication |
string | — |
ClientIP |
string | — |
ClientIPAddress |
string | — |
ClientMachineName |
string | — |
ClientProcessName |
string | — |
ExchangeMetaData |
string | — |
Id |
string | — |
InternalLogonType |
int | — |
Item |
string | — |
LogonType |
int | — |
LogonUserDisplayName |
string | — |
LogonUserSid |
string | — |
MailboxGuid |
string | — |
MailboxOwnerSid |
string | — |
MailboxOwnerUPN |
string | — |
ModifiedObjectResolvedName |
string | — |
ModifiedProperties |
string | — |
ObjectId |
string | — |
Operation |
string | — |
OperationProperties |
string | — |
OrganizationId |
string | — |
OrganizationName |
string | — |
OriginatingServer |
string | — |
PolicyDetails |
string | — |
RecordType |
int | — |
ResultStatus |
string | — |
Scope |
int | — |
Sender |
string | — |
UserId |
string | — |
UserKey |
string | — |
UserType |
int | — |
Workload |
string | — |
formid |
string | — |
receivers |
string | — |
msft_o365_sharepoint_online_raw
| Field | Type | Array? |
|---|---|---|
AppAccessContext |
string | — |
ApplicationDisplayName |
string | — |
AuthenticationType |
string | — |
BrowserName |
string | — |
ClientIP |
string | — |
DestinationFileExtension |
string | — |
DestinationFileName |
string | — |
EventSource |
string | — |
ExceptionInfo |
string | — |
Id |
string | — |
ItemType |
string | — |
ListTitle |
string | — |
ModifiedProperties |
string | — |
ObjectId |
string | — |
Operation |
string | — |
OrganizationId |
string | — |
Platform |
string | — |
PolicyDetails |
string | — |
RecordType |
int | — |
ResultStatus |
string | — |
Scope |
int | — |
Severity |
string | — |
SharePointMetaData |
string | — |
Site |
string | — |
SiteUrl |
string | — |
Source |
string | — |
SourceFileExtension |
string | — |
SourceFileName |
string | — |
SourceRelativeUrl |
string | — |
TargetUserOrGroupName |
string | — |
UserAgent |
string | — |
UserId |
string | — |
UserKey |
string | — |
UserType |
int | — |
Workload |
string | — |
msft_o365_dlp_raw
| Field | Type | Array? |
|---|---|---|
AppAccessContext |
string | — |
EndpointMetaData |
string | — |
ExceptionInfo |
string | — |
ExchangeMetaData |
string | — |
Id |
string | — |
ObjectId |
string | — |
Operation |
string | — |
OrganizationId |
string | — |
PolicyDetails |
string | — |
RecordType |
int | — |
ResultStatus |
string | — |
Scope |
int | — |
SharePointMetaData |
string | — |
UserId |
string | — |
UserKey |
string | — |
UserType |
int | — |
Workload |
string | — |
evaluationsource |
string | — |
msft_o365_emails_raw
| Field | Type | Array? |
|---|---|---|
attachments |
string | — |
bccRecipients |
string | — |
ccRecipients |
string | — |
from |
string | — |
hasAttachments |
boolean | — |
id |
string | — |
importance |
string | — |
internetMessageHeaders |
string | — |
internetMessageId |
string | — |
isDeliveryReceiptRequested |
boolean | — |
isDraft |
boolean | — |
isRead |
boolean | — |
isReadReceiptRequested |
boolean | — |
mailboxOwner |
string | — |
receivedDateTime |
datetime | — |
replyTo |
string | — |
sender |
string | — |
sentDateTime |
datetime | — |
subject |
string | — |
toRecipients |
string | — |
webLink |
string | — |