Microsoft Defender For Cloud Parsing Rule

Parsing Rule

Microsoft Defender for Cloud

Details

IDMicrosoft_Defender_For_Cloud_ParsingRule
From Version8.3.0

Rules (XQL)

[INGEST:vendor = "microsoft", product = "defender_for_cloud", target_dataset = "microsoft_defender_for_cloud_raw", no_hit = keep]
filter _collector_type = "Azure Event Hub" and to_string(TimeGenerated) ~= "\w{3}\s+\d+\s+\d{4}\s\d{2}\:\d{2}\:\d{2}"
| alter _time = parse_timestamp("%b %d %Y %H:%M:%S", to_string(TimeGenerated));