Tanium Threat Response Modeling Rule

{
    "tanium_threat_response_raw": {
      "_raw_log": {
          "type": "string",
          "is_array": false
        }
    }
}