Microsoft Graph Security Parsing Rules

Details

Rules (XQL)

[INGEST:vendor="msft", product="Graph Security Alerts", target_dataset="msft_graph_security_alerts_raw", no_hit=keep]
filter to_string(createdDateTime) ~= "\d{4}\-\d{2}\-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?Z"
| alter _time = parse_timestamp("%Y-%m-%dT%H:%M:%E*SZ", to_string(createdDateTime));