[MODEL: dataset = microsoft_defender_for_cloud_raw] // XDM mapping based on the alerts API schema (https://learn.microsoft.com/en-us/rest/api/defenderforcloud-composite/alerts?view=rest-defenderforcloud-composite-latest&preserve-view=true). filter properties != null // Fields extractions | alter Entities = json_extract_array(properties, "$.entities") | alter azureId = arraystring(arraymap(Entities, json_extract_scalar("@element", "$.azureID")), ","), commandLine = arraystring(arraymap(Entities, json_extract_scalar("@element", "$.commandLine")), ","), address = arraymap(Entities, json_extract_scalar("@element", "$.address")), clientIPAddress = arraycreate(json_extract_scalar(properties, "$.extendedProperties.client IP Address")), hostname = arraystring(arraymap(Entities, json_extract_scalar("@element", "$.hostName")), ",") // Fields mapping | alter xdm.observer.unique_identifier = id, xdm.observer.name = name, xdm.alert.name = json_extract_scalar(properties, "$.alertDisplayName"), xdm.alert.category = json_extract_scalar(properties, "$.alertType"), xdm.alert.description = json_extract_scalar(properties, "$.description"), xdm.source.user.domain = json_extract_scalar(properties, "$.extendedProperties.domain name"), xdm.source.user.username = json_extract_scalar(properties, "$.extendedProperties.user name"), xdm.source.process.pid = to_number(json_extract_scalar(properties, "$.extendedProperties.suspicious Process Id")), xdm.source.process.name = json_extract_scalar(properties, "$.extendedProperties.suspicious Process"), xdm.source.process.command_line = json_extract_scalar(properties, "$.extendedProperties.suspicious Command Line"), xdm.alert.mitre_tactics = arraycreate(json_extract_scalar(properties, "$.extendedProperties.killChainIntent")), xdm.source.host.ipv4_addresses = arraycreate(json_extract_scalar(properties, "$.extendedProperties.attacker IP Address")), xdm.target.process.name = json_extract_scalar(properties, "$.extendedProperties.process name"), xdm.target.process.pid = to_number(json_extract_scalar(properties, "$.extendedProperties.process id")), xdm.target.process.parent_id = json_extract_scalar(properties, "$.extendedProperties.parent process id"), xdm.observer.product = json_extract_scalar(properties, "$.productName"), xdm.alert.severity = json_extract_scalar(properties, "$.severity"), xdm.event.outcome_reason = json_extract_scalar(properties, "$.status"), xdm.alert.original_alert_id = json_extract_scalar(properties, "$.systemAlertId"), xdm.alert.mitre_techniques = json_extract_array(properties, "$.techniques"), xdm.observer.vendor = json_extract_scalar(properties, "$.vendorName"), xdm.observer.version = json_extract_scalar(properties, "$.version"), xdm.observer.type = type, xdm.target.resource.id = arraystring(arraymap(Entities, json_extract_scalar("@element", """$['$id']""")), ","), xdm.target.host.fqdn = arraystring(arraymap(Entities, json_extract_scalar("@element", "$.dnsDomain")), ","), xdm.target.host.os = arraystring(arraymap(Entities, json_extract_scalar("@element", "$.OsVersion")), ","), xdm.target.host.os_family = arraystring(arraymap(Entities, json_extract_scalar("@element", "$.osFamily")), ","), xdm.target.file.path = arraystring(arraymap(Entities, json_extract_scalar("@element", "$.directory")), ","), xdm.target.file.filename = arraystring(arraymap(Entities, json_extract_scalar("@element", "$.name")), ","), xdm.target.process.identifier = arraystring(arraymap(Entities, json_extract_scalar("@element", "$.processId")), ","), xdm.target.agent.type = arraystring(arraymap(Entities, json_extract_scalar("@element", "$.type")), ","), xdm.target.host.device_id = coalesce(azureId, json_extract_scalar(properties, "$.resourceIdentifiers.id")), xdm.target.process.command_line = coalesce(commandLine, json_extract_scalar(properties, "$.extendedProperties.command line")), xdm.target.host.ipv4_addresses = coalesce(address, clientIPAddress), xdm.target.host.hostname = coalesce(json_extract_scalar(properties, "$.compromisedEntity"), hostname); // XDM mapping based on the SecurityAlert schema (https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/SecurityAlert). filter ExtendedProperties != null | alter Entities = Entities ->[], ResourceIdentifiers = ResourceIdentifiers -> [] // Entities values | alter Entities_account_username = arraystring(arraymap(Entities, if(json_extract_scalar("@element", "$.Type") = "account" and json_extract_scalar("@element", "$.Name") not in ("", null), json_extract_scalar("@element", "$.Name"), json_extract_scalar("@element", "$.Type") = "account" and json_extract_scalar("@element", "$.Name") in ("", null), "-", null)), ", "), Entities_account_Identifier = arraystring(arraymap(Entities, if(json_extract_scalar("@element", "$.Type") = "account" and json_extract_scalar("@element", "$.Sid") not in ("", null), json_extract_scalar("@element", "$.Sid"), json_extract_scalar("@element", "$.Type") = "account" and json_extract_scalar("@element", "$.AadUserId") not in ("", null), json_extract_scalar("@element", "$.AadUserId"), json_extract_scalar("@element", "$.Type") = "account" and json_extract_scalar("@element", "$.Id") not in ("", null), json_extract_scalar("@element", "$.Id"), json_extract_scalar("@element", "$.Type") = "account" and json_extract_scalar("@element", "$.Sid") in ("", null) and json_extract_scalar("@element", "$.Id") in ("", null) and json_extract_scalar("@element", "$.AadUserId") in ("", null), "-", null)), ", "), Entities_account_LogonId = arraystring(arraymap(Entities, if(json_extract_scalar("@element", "$.Type") = "account" and json_extract_scalar("@element", "$.LogonId") not in ("", null), json_extract_scalar("@element", "$.LogonId"), json_extract_scalar("@element", "$.Type") = "account" and json_extract_scalar("@element", "$.LogonId") in ("", null), "-", null)), ", "), Entities_host_HostName = arraystring(arraymap(Entities, if(json_extract_scalar("@element", "$.Type") = "host" and json_extract_scalar("@element", "$.HostName") not in ("", null), json_extract_scalar("@element", "$.HostName"), json_extract_scalar("@element", "$.Type") = "host" and json_extract_scalar("@element", "$.HostName") in ("", null), "-", null)), ", "), Entities_host_OS = arraystring(arraymap(Entities, if(json_extract_scalar("@element", "$.Type") = "host" and json_extract_scalar("@element", "$.OSFamily") not in ("", null) and json_extract_scalar("@element", "$.OSVersion") not in ("", null), concat(json_extract_scalar("@element", "$.OSFamily"), " ", json_extract_scalar("@element", "$.OSVersion")), json_extract_scalar("@element", "$.Type") = "host" and json_extract_scalar("@element", "$.OSFamily") not in ("", null), json_extract_scalar("@element", "$.OSFamily"), json_extract_scalar("@element", "$.Type") = "host" and json_extract_scalar("@element", "$.OSFamily") in ("", null), "-", null)), ", "), Entities_ip_address = arraymap(Entities, if(json_extract_scalar("@element", "$.Type") = "ip" and json_extract_scalar("@element", "$.Address") not in ("", null), json_extract_scalar("@element", "$.Address"), json_extract_scalar("@element", "$.Type") = "ip" and json_extract_scalar("@element", "$.Address") in ("", null), "-", null)), Entities_process_id = arraystring(arraymap(Entities, if(json_extract_scalar("@element", "$.Type") = "process" and json_extract_scalar("@element", "$.ProcessId") not in ("", null), json_extract_scalar("@element", "$.ProcessId"), json_extract_scalar("@element", "$.Type") = "process" and json_extract_scalar("@element", "$.ProcessId") in ("", null), "-", null)), ", "), Entities_process_commandline = arraystring(arraymap(Entities, if(json_extract_scalar("@element", "$.Type") = "process" and json_extract_scalar("@element", "$.CommandLine") not in ("", null), json_extract_scalar("@element", "$.CommandLine"), json_extract_scalar("@element", "$.Type") = "process" and json_extract_scalar("@element", "$.CommandLine") in ("", null), "-", null)), ", "), Entities_process_image_filename = arraystring(arraymap(Entities, if(json_extract_scalar("@element", "$.Type") = "process" and json_extract_scalar("@element", "$.ImageFile.Name") not in ("", null), json_extract_scalar("@element", "$.ImageFile.Name"), json_extract_scalar("@element", "$.Type") = "process" and json_extract_scalar("@element", "$.ImageFile.Name") in ("", null), "-", null)), ", "), Entities_process_image_directory = arraystring(arraymap(Entities, if(json_extract_scalar("@element", "$.Type") = "process" and json_extract_scalar("@element", "$.ImageFile.Directory") not in ("", null), json_extract_scalar("@element", "$.ImageFile.Directory"), json_extract_scalar("@element", "$.Type") = "process" and json_extract_scalar("@element", "$.ImageFile.Directory") in ("", null), "-", null)), ", "), Entities_file_Name = arraystring(arraymap(Entities, if(json_extract_scalar("@element", "$.Type") = "file" and json_extract_scalar("@element", "$.Name") not in ("", null), json_extract_scalar("@element", "$.Name"), json_extract_scalar("@element", "$.Type") = "file" and json_extract_scalar("@element", "$.Name") in ("", null), "-", null)), ", "), Entities_file_Directory = arraystring(arraymap(Entities, if(json_extract_scalar("@element", "$.Type") = "file" and json_extract_scalar("@element", "$.Directory") not in ("", null), json_extract_scalar("@element", "$.Directory"), json_extract_scalar("@element", "$.Type") = "file" and json_extract_scalar("@element", "$.Directory") in ("", null), "-", null)), ", "), Entities_filehash_md5 = arraystring(arraymap(Entities, if(json_extract_scalar("@element", "$.Type") = "filehash" and json_extract_scalar("@element", "$.Value") not in ("", null) and json_extract_scalar("@element", "$.Algorithm") = "MD5", json_extract_scalar("@element", "$.Value"), json_extract_scalar("@element", "$.Type") = "filehash" and json_extract_scalar("@element", "$.Value") in ("", null) and json_extract_scalar("@element", "$.Algorithm") = "MD5", "-", null)), ", "), Entities_filehash_sha256 = arraystring(arraymap(Entities, if(json_extract_scalar("@element", "$.Type") = "filehash" and json_extract_scalar("@element", "$.Value") not in ("", null) and json_extract_scalar("@element", "$.Algorithm") = "SHA256", json_extract_scalar("@element", "$.Value"), json_extract_scalar("@element", "$.Type") = "filehash" and json_extract_scalar("@element", "$.Value") in ("", null) and json_extract_scalar("@element", "$.Algorithm") = "SHA256", "-", null)), ", ") // Entities IP fields filtering | alter Entities_ip_address_local_v4 = arraymap(Entities_ip_address, if(incidr("@element","10.0.0.0/8") or incidr("@element","127.0.0.0/8") or incidr("@element","169.254.0.0/16") or incidr("@element","172.16.0.0/12") or incidr("@element","192.168.0.0/16"), "@element", "-")), //Entities_ip_address_local_v6 = arraymap(Entities_ip_address, if(incidr6("@element","fc00::/7") or incidr6("@element","fd00::/7") or incidr6("@element","fe80::/64") or incidr6("@element","::/128") or incidr6("@element","::1/128"), "@element", "-")), Entities_ip_address_public_v4 = arraymap(Entities_ip_address, if(not incidr("@element","10.0.0.0/8") or not incidr("@element","127.0.0.0/8") or not incidr("@element","169.254.0.0/16") or not incidr("@element","172.16.0.0/12") or not incidr("@element","192.168.0.0/16"), "@element", "-")), //Entities_ip_address_public_v6 = arraymap(Entities_ip_address, if(not incidr6("@element","fc00::/7") or not incidr6("@element","fd00::/7") or not incidr6("@element","fe80::/64") or not incidr6("@element","::/128") or not incidr6("@element","::1/128"), "@element", "-")), Entities_ip_address_v6 = arraymap(Entities_ip_address, if("@element" ~= "(?:[a-fA-F\d]{0,4}\:){1,7}[a-fA-F\d]{0,4}", "@element", "-")) // Remove empty entities fields values | alter Entities_account_username = if(Entities_account_username ~= "^[\,\s\-]+$" or Entities_account_username = "", null, Entities_account_username), Entities_account_Identifier = if(Entities_account_Identifier ~= "^[\,\s\-]+$" or Entities_account_Identifier = "", null, Entities_account_Identifier), Entities_account_LogonId = if(Entities_account_LogonId ~= "^[\,\s\-]+$" or Entities_account_LogonId = "", null, Entities_account_LogonId), Entities_host_HostName = if(Entities_host_HostName ~= "^[\,\s\-]+$" or Entities_host_HostName = "", null, Entities_host_HostName), Entities_host_OS = if(Entities_host_OS ~= "^[\,\s\-]+$" or Entities_host_OS = "", null, Entities_host_OS), Entities_ip_address_local_v4 = if(arraystring(Entities_ip_address_local_v4, ",") ~= "^[\,\s\-]+$" or Entities_ip_address_local_v4 = "", null, Entities_ip_address_local_v4), Entities_ip_address_public_v4 = if(arraystring(Entities_ip_address_public_v4, ",") ~= "^[\,\s\-]+$" or Entities_ip_address_public_v4 = "", null, Entities_ip_address_public_v4), Entities_ip_address_v6 = if(arraystring(Entities_ip_address_v6, ",") ~= "^[\,\s\-]+$" or Entities_ip_address_v6 = "", null, Entities_ip_address_v6), Entities_process_id = if(Entities_process_id ~= "^[\,\s\-]+$" or Entities_process_id = "", null, Entities_process_id), Entities_process_commandline = if(Entities_process_commandline ~= "^[\,\s\-]+$" or Entities_process_commandline = "", null, Entities_process_commandline), Entities_process_image_filename = if(Entities_process_image_filename ~= "^[\,\s\-]+$" or Entities_process_image_filename = "", null, Entities_process_image_filename), Entities_process_image_directory = if(Entities_process_image_directory ~= "^[\,\s\-]+$" or Entities_process_image_directory = "", null, Entities_process_image_directory), Entities_file_Name = if(Entities_file_Name ~= "^[\,\s\-]+$" or Entities_file_Name = "", null, Entities_file_Name), Entities_file_Directory = if(Entities_file_Directory ~= "^[\,\s\-]+$" or Entities_file_Directory = "", null, Entities_file_Directory), Entities_filehash_md5 = if(Entities_filehash_md5 ~= "^[\,\s\-]+$" or Entities_filehash_md5 = "", null, Entities_filehash_md5), Entities_filehash_sha256 = if(Entities_filehash_sha256 ~= "^[\,\s\-]+$" or Entities_filehash_sha256 = "", null, Entities_filehash_sha256) // ExtendedProperties values | alter ExtendedProperties_AAD_user_id = json_extract_scalar(ExtendedProperties, "$.AAD user ID"), ExtendedProperties_Account_Session_Id = json_extract_scalar(ExtendedProperties, "$.Account Session Id"), ExtendedProperties_Activity_type = json_extract_scalar(ExtendedProperties, "$.Activity type"), ExtendedProperties_Application = json_extract_scalar(ExtendedProperties, "$.Application"), ExtendedProperties_Application_name = json_extract_scalar(ExtendedProperties, "$.Application name"), ExtendedProperties_Attacker_IP_Address_v4 = if(json_extract_scalar(ExtendedProperties, "$.Attacker IP Address") ~= "(?:\d{1,3}\.){3}\d{1,3}", json_extract_scalar(ExtendedProperties, "$.Attacker IP Address"), null), ExtendedProperties_Attacker_IP_Address_v6 = if(json_extract_scalar(ExtendedProperties, "$.Attacker IP Address") ~= "(?:[a-fA-F\d]{0,4}\:){1,7}[a-fA-F\d]{0,4}", json_extract_scalar(ExtendedProperties, "$.Attacker IP Address"), null), ExtendedProperties_Authentication_type = json_extract_scalar(ExtendedProperties, "$.Authentication type"), ExtendedProperties_Client_Application = if(json_extract_scalar(ExtendedProperties, "$.Client Application") != null, json_extract_scalar(ExtendedProperties, "$.Client Application"), json_extract_scalar(ExtendedProperties, "$.Client application") != null, json_extract_scalar(ExtendedProperties, "$.Client application"), null), ExtendedProperties_Client_Hostname = json_extract_scalar(ExtendedProperties, "$.Client Hostname"), ExtendedProperties_Client_IP_Address_v4 = if(json_extract_scalar(ExtendedProperties, "$.Client IP Address") ~= "(?:\d{1,3}\.){3}\d{1,3}", json_extract_scalar(ExtendedProperties, "$.Client IP Address"), json_extract_scalar(ExtendedProperties, "$.Client IP address") ~= "(?:\d{1,3}\.){3}\d{1,3}", json_extract_scalar(ExtendedProperties, "$.Client IP address"), null), ExtendedProperties_Client_IP_Address_v6 = if(json_extract_scalar(ExtendedProperties, "$.Client IP Address") ~= "(?:[a-fA-F\d]{0,4}\:){1,7}[a-fA-F\d]{0,4}", json_extract_scalar(ExtendedProperties, "$.Client IP Address"), json_extract_scalar(ExtendedProperties, "$.Client IP address") ~= "(?:[a-fA-F\d]{0,4}\:){1,7}[a-fA-F\d]{0,4}", json_extract_scalar(ExtendedProperties, "$.Client IP address"), null), ExtendedProperties_Client_Principal_Name = if(json_extract_scalar(ExtendedProperties, "$.Client Principal Name") != null, json_extract_scalar(ExtendedProperties, "$.Client Principal Name"), json_extract_scalar(ExtendedProperties, "$.Client principal name") != null, json_extract_scalar(ExtendedProperties, "$.Client principal name"), null), ExtendedProperties_Command = json_extract_scalar(ExtendedProperties, "$.Command"), ExtendedProperties_Compromised_Host = json_extract_scalar(ExtendedProperties, "$.Compromised Host"), ExtendedProperties_CompromisedEntity = json_extract_scalar(ExtendedProperties, "$.CompromisedEntity"), ExtendedProperties_Database = json_extract_scalar(ExtendedProperties, "$.Database"), ExtendedProperties_Database_name = json_extract_scalar(ExtendedProperties, "$.Database name"), ExtendedProperties_file = json_extract_scalar(ExtendedProperties, "$.File"), ExtendedProperties_IP_address_v4 = if(json_extract_scalar(ExtendedProperties, "$.IP address") ~= "(?:\d{1,3}\.){3}\d{1,3}", json_extract_scalar(ExtendedProperties, "$.IP address"), null), ExtendedProperties_IP_address_v6 = if(json_extract_scalar(ExtendedProperties, "$.IP address") ~= "(?:[a-fA-F\d]{0,4}\:){1,7}[a-fA-F\d]{0,4}", json_extract_scalar(ExtendedProperties, "$.IP address"), null), ExtendedProperties_Image_Name = if(json_extract_scalar(ExtendedProperties, "$.Image Name") != null, json_extract_scalar(ExtendedProperties, "$.Image Name"), json_extract_scalar(ExtendedProperties, "$.ImageName") != null, json_extract_scalar(ExtendedProperties, "$.ImageName"), null), ExtendedProperties_Payload_size = multiply(to_number(arrayindex(regextract(json_extract_scalar(ExtendedProperties, "$['Payload Size (KB)']"), "(\d+)\.?\d*"),0)), 1024), ExtendedProperties_Port = to_number(json_extract_scalar(ExtendedProperties, "$.Port")), ExtendedProperties_Process_Id = json_extract_scalar(ExtendedProperties, "$.Process Id"), ExtendedProperties_Process_Name = json_extract_scalar(ExtendedProperties, "$.Process Name"), ExtendedProperties_Request_status = json_extract_scalar(ExtendedProperties, "$.Request status"), ExtendedProperties_Resource_name = json_extract_scalar(ExtendedProperties, "$.Resource name"), ExtendedProperties_Resource_Type = if(json_extract_scalar(ExtendedProperties, "$.Resource type") != null, json_extract_scalar(ExtendedProperties, "$.Resource type"), json_extract_scalar(ExtendedProperties, "$.resourceType") != null, json_extract_scalar(ExtendedProperties, "$.resourceType"), json_extract_scalar(ExtendedProperties, "$.ResourceType") != null, json_extract_scalar(ExtendedProperties, "$.ResourceType"), null), ExtendedProperties_ResourceId = json_extract_scalar(ExtendedProperties, "$.ResourceId"), ExtendedProperties_Result_Signature = json_extract_scalar(ExtendedProperties, "$.Result Signature"), ExtendedProperties_SHA_256 = json_extract_scalar(ExtendedProperties, "$.SHA-256"), ExtendedProperties_Source_IP_address_v4 = if(json_extract_scalar(ExtendedProperties, "$.Source IP address") ~= "(?:\d{1,3}\.){3}\d{1,3}", json_extract_scalar(ExtendedProperties, "$.Source IP address"), null), ExtendedProperties_Source_IP_address_v6 = if(json_extract_scalar(ExtendedProperties, "$.Source IP address") ~= "(?:[a-fA-F\d]{0,4}\:){1,7}[a-fA-F\d]{0,4}", json_extract_scalar(ExtendedProperties, "$.Source IP address"), null), ExtendedProperties_Status_Code = json_extract_scalar(ExtendedProperties, "$.Status Code"), ExtendedProperties_Suspicious_Command_Line = if(json_extract_scalar(ExtendedProperties, "$.Suspicious Command Line") != null, json_extract_scalar(ExtendedProperties, "$.Suspicious Command Line"), json_extract_scalar(ExtendedProperties, "$.Suspicious command") != null, json_extract_scalar(ExtendedProperties, "$.Suspicious command"), null), ExtendedProperties_Suspicious_Process = json_extract_scalar(ExtendedProperties, "$.Suspicious Process"), ExtendedProperties_Suspicious_Process_Id = json_extract_scalar(ExtendedProperties, "$.Suspicious Process Id"), ExtendedProperties_Top_anomalous_queries = json_extract_scalar(ExtendedProperties, "$.Top anomalous queries"), ExtendedProperties_Top_suspicious_queries = json_extract_scalar(ExtendedProperties, "$.Top suspicious queries"), ExtendedProperties_Known_Port = json_extract_scalar(ExtendedProperties, "$.Known Port"), ExtendedProperties_URL = json_extract_scalar(ExtendedProperties, "$.URL"), ExtendedProperties_Sensor_Id = json_extract_scalar(ExtendedProperties, "$.SensorId"), ExtendedProperties_Device_Id = json_extract_scalar(ExtendedProperties, "$.DeviceId"), ExtendedProperties_Source_Device = json_extract_scalar(extendedproperties, "$.SourceDevice"), ExtendedProperties_Category = json_extract_scalar(ExtendedProperties, "$.Category"), ExtendedProperties_Destination_Device = json_extract_scalar(extendedproperties, "$.DestinationDevice"), ExtendedProperties_User_Principal_Name = json_extract_scalar(ExtendedProperties, "$.userprincipalname"), ExtendedProperties_User_Name = if(json_extract_scalar(ExtendedProperties, "$.User Name") != null, json_extract_scalar(ExtendedProperties, "$.User Name"), json_extract_scalar(ExtendedProperties, "$.Username") != null, json_extract_scalar(ExtendedProperties, "$.Username"), null), ExtendedProperties_User_Agent = json_extract_scalar(ExtendedProperties, "$.User agent"), ExtendedProperties_Protocol = json_extract_scalar(ExtendedProperties, "$.Protocol"), ExtendedProperties_Http_Method = json_extract_scalar(ExtendedProperties, "$['HTTP Request Method']") // XDM fields | alter // Common fields xdm.source.agent.identifier = if(AgentId != "", AgentId, null), xdm.alert.name = coalesce(AlertDisplayName,AlertName), xdm.alert.subcategory = AlertType, xdm.session_context_id = if(CorrelationKey != "", CorrelationKey, null), xdm.alert.description = Description, xdm.alert.severity = coalesce(Severity,AlertSeverity), xdm.alert.original_alert_id = SystemAlertId, xdm.source.cloud.project_id = arraystring(arraymap(ResourceIdentifiers, if(json_extract_scalar("@element", "$.AzureResourceTenantId") != null, json_extract_scalar("@element", "$.AzureResourceTenantId"), json_extract_scalar("@element", "$.AadTenantId") != null, json_extract_scalar("@element", "$.AadTenantId"), json_extract_scalar("@element", "$.workspaceId") != null, json_extract_scalar("@element", "$.workspaceId"), "-")), ", "), // Entities and Extended Properties fields xdm.source.user.identifier = coalesce(ExtendedProperties_AAD_user_id, Entities_account_Identifier), xdm.logon.logon_guid = coalesce(ExtendedProperties_Account_Session_Id, Entities_account_LogonId), xdm.event.operation_sub_type = ExtendedProperties_Activity_type, xdm.source.application.name = coalesce(ExtendedProperties_Application, ExtendedProperties_Application_name, ExtendedProperties_Client_Application), xdm.source.ipv4 = coalesce(ExtendedProperties_Attacker_IP_Address_v4, ExtendedProperties_Source_IP_address_v4, SourceDeviceAddress), xdm.source.ipv6 = coalesce(ExtendedProperties_Attacker_IP_Address_v6, ExtendedProperties_Source_IP_address_v6), xdm.auth.service = ExtendedProperties_Authentication_type, xdm.target.host.hostname = coalesce(ExtendedProperties_Client_Hostname, ExtendedProperties_Compromised_Host, Entities_host_HostName, ExtendedProperties_Destination_Device), xdm.target.ipv4 = coalesce(ExtendedProperties_Client_IP_Address_v4, ExtendedProperties_IP_address_v4, DestinationDeviceAddress), xdm.target.ipv6 = coalesce(ExtendedProperties_Client_IP_Address_v6, ExtendedProperties_IP_address_v6), xdm.source.user.username = coalesce(ExtendedProperties_Client_Principal_Name, ExtendedProperties_User_Name, Entities_account_username, ExtendedProperties_User_Principal_Name), xdm.source.process.command_line = coalesce(ExtendedProperties_Command, ExtendedProperties_Suspicious_Command_Line, Entities_process_commandline), xdm.target.resource.name = coalesce(ExtendedProperties_CompromisedEntity, ExtendedProperties_Resource_name), xdm.target.resource.type = ExtendedProperties_Resource_Type, xdm.target.resource.id = ExtendedProperties_ResourceId, xdm.observer.unique_identifier = ExtendedProperties_Device_Id, xdm.database.name = coalesce(ExtendedProperties_Database, ExtendedProperties_Database_name), xdm.target.file.filename = coalesce(ExtendedProperties_file, Entities_file_Name), xdm.target.host.image = ExtendedProperties_Image_Name, xdm.observer.name = ExtendedProperties_Sensor_Id, xdm.source.host.hostname = ExtendedProperties_Source_Device, xdm.target.sent_bytes = to_integer(ExtendedProperties_Payload_size), xdm.target.port = coalesce(ExtendedProperties_Port, to_integer(arrayindex(regextract(ExtendedProperties_Known_Port,"\((\d+)\)$"),0))), xdm.source.process.identifier = coalesce(ExtendedProperties_Process_Id, ExtendedProperties_Suspicious_Process_Id, Entities_process_id), xdm.source.process.name = coalesce(ExtendedProperties_Process_Name, ExtendedProperties_Suspicious_Process), xdm.event.outcome = if(lowercase(ExtendedProperties_Request_status) contains "succ", XDM_CONST.OUTCOME_SUCCESS, lowercase(ExtendedProperties_Request_status) contains "fail", XDM_CONST.OUTCOME_FAILED, lowercase(ExtendedProperties_Result_Signature) contains "ok", XDM_CONST.OUTCOME_SUCCESS, lowercase(ExtendedProperties_Result_Signature) contains "unauth" or lowercase(ExtendedProperties_Result_Signature) contains " not ", XDM_CONST.OUTCOME_FAILED, null), xdm.target.file.sha256 = coalesce(ExtendedProperties_SHA_256, Entities_filehash_sha256), xdm.network.http.response_code = if(ExtendedProperties_Status_Code = "100", XDM_CONST.HTTP_RSP_CODE_CONTINUE, ExtendedProperties_Status_Code = "101", XDM_CONST.HTTP_RSP_CODE_SWITCHING_PROTOCOLS, ExtendedProperties_Status_Code = "102", XDM_CONST.HTTP_RSP_CODE_PROCESSING, ExtendedProperties_Status_Code = "103", XDM_CONST.HTTP_RSP_CODE_EARLY_HINTS, ExtendedProperties_Status_Code = "200", XDM_CONST.HTTP_RSP_CODE_OK, ExtendedProperties_Status_Code = "201", XDM_CONST.HTTP_RSP_CODE_CREATED, ExtendedProperties_Status_Code = "202", XDM_CONST.HTTP_RSP_CODE_ACCEPTED, ExtendedProperties_Status_Code = "203", XDM_CONST.HTTP_RSP_CODE_NON__AUTHORITATIVE_INFORMATION, ExtendedProperties_Status_Code = "204", XDM_CONST.HTTP_RSP_CODE_NO_CONTENT, ExtendedProperties_Status_Code = "205", XDM_CONST.HTTP_RSP_CODE_RESET_CONTENT, ExtendedProperties_Status_Code = "206", XDM_CONST.HTTP_RSP_CODE_PARTIAL_CONTENT, ExtendedProperties_Status_Code = "207", XDM_CONST.HTTP_RSP_CODE_MULTI__STATUS, ExtendedProperties_Status_Code = "208", XDM_CONST.HTTP_RSP_CODE_ALREADY_REPORTED, ExtendedProperties_Status_Code = "226", XDM_CONST.HTTP_RSP_CODE_IM_USED, ExtendedProperties_Status_Code = "300", XDM_CONST.HTTP_RSP_CODE_MULTIPLE_CHOICES, ExtendedProperties_Status_Code = "301", XDM_CONST.HTTP_RSP_CODE_MOVED_PERMANENTLY, ExtendedProperties_Status_Code = "302", XDM_CONST.HTTP_RSP_CODE_FOUND, ExtendedProperties_Status_Code = "303", XDM_CONST.HTTP_RSP_CODE_SEE_OTHER, ExtendedProperties_Status_Code = "304", XDM_CONST.HTTP_RSP_CODE_NOT_MODIFIED, ExtendedProperties_Status_Code = "305", XDM_CONST.HTTP_RSP_CODE_USE_PROXY, ExtendedProperties_Status_Code = "307", XDM_CONST.HTTP_RSP_CODE_TEMPORARY_REDIRECT, ExtendedProperties_Status_Code = "308", XDM_CONST.HTTP_RSP_CODE_PERMANENT_REDIRECT, ExtendedProperties_Status_Code = "400", XDM_CONST.HTTP_RSP_CODE_BAD_REQUEST, ExtendedProperties_Status_Code = "401", XDM_CONST.HTTP_RSP_CODE_UNAUTHORIZED, ExtendedProperties_Status_Code = "402", XDM_CONST.HTTP_RSP_CODE_PAYMENT_REQUIRED, ExtendedProperties_Status_Code = "403", XDM_CONST.HTTP_RSP_CODE_FORBIDDEN, ExtendedProperties_Status_Code = "404", XDM_CONST.HTTP_RSP_CODE_NOT_FOUND, ExtendedProperties_Status_Code = "405", XDM_CONST.HTTP_RSP_CODE_METHOD_NOT_ALLOWED, ExtendedProperties_Status_Code = "406", XDM_CONST.HTTP_RSP_CODE_NOT_ACCEPTABLE, ExtendedProperties_Status_Code = "407", XDM_CONST.HTTP_RSP_CODE_PROXY_AUTHENTICATION_REQUIRED, ExtendedProperties_Status_Code = "408", XDM_CONST.HTTP_RSP_CODE_REQUEST_TIMEOUT, ExtendedProperties_Status_Code = "409", XDM_CONST.HTTP_RSP_CODE_CONFLICT, ExtendedProperties_Status_Code = "410", XDM_CONST.HTTP_RSP_CODE_GONE, ExtendedProperties_Status_Code = "411", XDM_CONST.HTTP_RSP_CODE_LENGTH_REQUIRED, ExtendedProperties_Status_Code = "412", XDM_CONST.HTTP_RSP_CODE_PRECONDITION_FAILED, ExtendedProperties_Status_Code = "413", XDM_CONST.HTTP_RSP_CODE_CONTENT_TOO_LARGE, ExtendedProperties_Status_Code = "414", XDM_CONST.HTTP_RSP_CODE_URI_TOO_LONG, ExtendedProperties_Status_Code = "415", XDM_CONST.HTTP_RSP_CODE_UNSUPPORTED_MEDIA_TYPE, ExtendedProperties_Status_Code = "416", XDM_CONST.HTTP_RSP_CODE_RANGE_NOT_SATISFIABLE, ExtendedProperties_Status_Code = "417", XDM_CONST.HTTP_RSP_CODE_EXPECTATION_FAILED, ExtendedProperties_Status_Code = "421", XDM_CONST.HTTP_RSP_CODE_MISDIRECTED_REQUEST, ExtendedProperties_Status_Code = "422", XDM_CONST.HTTP_RSP_CODE_UNPROCESSABLE_CONTENT, ExtendedProperties_Status_Code = "423", XDM_CONST.HTTP_RSP_CODE_LOCKED, ExtendedProperties_Status_Code = "424", XDM_CONST.HTTP_RSP_CODE_FAILED_DEPENDENCY, ExtendedProperties_Status_Code = "425", XDM_CONST.HTTP_RSP_CODE_TOO_EARLY, ExtendedProperties_Status_Code = "426", XDM_CONST.HTTP_RSP_CODE_UPGRADE_REQUIRED, ExtendedProperties_Status_Code = "428", XDM_CONST.HTTP_RSP_CODE_PRECONDITION_REQUIRED, ExtendedProperties_Status_Code = "429", XDM_CONST.HTTP_RSP_CODE_TOO_MANY_REQUESTS, ExtendedProperties_Status_Code = "431", XDM_CONST.HTTP_RSP_CODE_REQUEST_HEADER_FIELDS_TOO_LARGE, ExtendedProperties_Status_Code = "451", XDM_CONST.HTTP_RSP_CODE_UNAVAILABLE_FOR_LEGAL_REASONS, ExtendedProperties_Status_Code = "500", XDM_CONST.HTTP_RSP_CODE_INTERNAL_SERVER_ERROR, ExtendedProperties_Status_Code = "501", XDM_CONST.HTTP_RSP_CODE_NOT_IMPLEMENTED, ExtendedProperties_Status_Code = "502", XDM_CONST.HTTP_RSP_CODE_BAD_GATEWAY, ExtendedProperties_Status_Code = "503", XDM_CONST.HTTP_RSP_CODE_SERVICE_UNAVAILABLE, ExtendedProperties_Status_Code = "504", XDM_CONST.HTTP_RSP_CODE_GATEWAY_TIMEOUT, ExtendedProperties_Status_Code = "505", XDM_CONST.HTTP_RSP_CODE_HTTP_VERSION_NOT_SUPPORTED, ExtendedProperties_Status_Code = "506", XDM_CONST.HTTP_RSP_CODE_VARIANT_ALSO_NEGOTIATES, ExtendedProperties_Status_Code = "507", XDM_CONST.HTTP_RSP_CODE_INSUFFICIENT_STORAGE, ExtendedProperties_Status_Code = "508", XDM_CONST.HTTP_RSP_CODE_LOOP_DETECTED, ExtendedProperties_Status_Code = "511", XDM_CONST.HTTP_RSP_CODE_NETWORK_AUTHENTICATION_REQUIRED, ExtendedProperties_Status_Code = null, null, to_string(ExtendedProperties_Status_Code)), xdm.database.statement = coalesce(ExtendedProperties_Top_anomalous_queries, ExtendedProperties_Top_suspicious_queries), xdm.target.url = ExtendedProperties_URL, xdm.source.user_agent = ExtendedProperties_User_Agent, xdm.network.ip_protocol = arrayindex(regextract(ExtendedProperties_Known_Port,"^(\w+)\s*\(\d+\)$"),0), xdm.target.file.directory = Entities_file_Directory, xdm.network.application_protocol_category = ExtendedProperties_Protocol, xdm.target.file.md5 = Entities_filehash_md5, xdm.event.description = if(ProductName = "Azure Security Center for IoT", object_create("HasMultipleViolations",json_extract_scalar(extendedproperties, "$.HasMultipleViolations"),"isNew",json_extract_scalar(extendedproperties, "$.isNew"),"ProcessedBySentinel",json_extract_scalar(extendedproperties, "$.ProcessedBySentinel"),"isLearnable",json_extract_scalar(extendedproperties, "$.isLearnable")), null), xdm.target.host.ipv4_addresses = Entities_ip_address_local_v4, xdm.event.operation = ExtendedProperties_Category, //xdm.target.host.ipv6_addresses = Entities_ip_address_local_v6, xdm.target.host.ipv4_public_addresses = Entities_ip_address_public_v4, //xdm.target.host.ipv6_public_addresses = Entities_ip_address_public_v6, xdm.target.host.ipv6_addresses = Entities_ip_address_v6, xdm.source.process.executable.directory = Entities_process_image_directory, xdm.source.process.executable.filename = Entities_process_image_filename, xdm.event.type = type, xdm.source.host.device_id = VendorOriginalId, xdm.alert.mitre_tactics = arraymap(Tactics -> [], if( "@element" ~= "Collection", XDM_CONST.MITRE_TACTIC_COLLECTION, "@element" ~= "CommandAndControl", XDM_CONST.MITRE_TACTIC_COMMAND_AND_CONTROL, "@element" ~= "CredentialAccess", XDM_CONST.MITRE_TACTIC_CREDENTIAL_ACCESS, "@element" ~= "DefenceEvasion", XDM_CONST.MITRE_TACTIC_DEFENSE_EVASION, "@element" ~= "Discovery", XDM_CONST.MITRE_TACTIC_DISCOVERY, "@element" ~= "Execution", XDM_CONST.MITRE_TACTIC_EXECUTION, "@element" ~= "Exfiltration", XDM_CONST.MITRE_TACTIC_EXFILTRATION, "@element" ~= "Impact", XDM_CONST.MITRE_TACTIC_IMPACT, "@element" ~= "InitialAccess", XDM_CONST.MITRE_TACTIC_INITIAL_ACCESS, "@element" ~= "LateralMovement", XDM_CONST.MITRE_TACTIC_LATERAL_MOVEMENT, "@element" ~= "Persistence", XDM_CONST.MITRE_TACTIC_PERSISTENCE, "@element" ~= "PrivilegeEscalation", XDM_CONST.MITRE_TACTIC_PRIVILEGE_ESCALATION, "@element" ~= "Reconnaissance", XDM_CONST.MITRE_TACTIC_RECONNAISSANCE, "@element" ~= "ResourceDevelopment", XDM_CONST.MITRE_TACTIC_RESOURCE_DEVELOPMENT, "@element")), xdm.alert.mitre_techniques = arraymap(Techniques -> [], if("@element"~="T0800","ACTIVATE_FIRMWARE_UPDATE_MODE", "@element"~="T0830","ADVERSARY_IN_THE_MIDDLE", "@element"~="T0878","ALARM_SUPPRESSION", "@element"~="T0802","AUTOMATED_COLLECTION", "@element"~="T0895","AUTORUN_IMAGE", "@element"~="T0803","BLOCK_COMMAND_MESSAGE", "@element"~="T0804","BLOCK_REPORTING_MESSAGE", "@element"~="T0805","BLOCK_SERIAL_COM", "@element"~="T0806","BRUTE_FORCE_I/O", "@element"~="T0892","CHANGE_CREDENTIAL", "@element"~="T0858","CHANGE_OPERATING_MODE", "@element"~="T0807","COMMAND_LINE_INTERFACE", "@element"~="T0885","COMMONLY_USED_PORT", "@element"~="T0884","CONNECTION_PROXY", "@element"~="T0879","DAMAGE_TO_PROPERTY", "@element"~="T0809","DATA_DESTRUCTION", "@element"~="T0811","DATA_FROM_INFORMATION_REPOSITORIES", "@element"~="T0893","DATA_FROM_LOCAL_SYSTEM", "@element"~="T0812","DEFAULT_CREDENTIALS", "@element"~="T0813","DENIAL_OF_CONTROL", "@element"~="T0814","DENIAL_OF_SERVICE", "@element"~="T0815","DENIAL_OF_VIEW", "@element"~="T0868","DETECT_OPERATING_MODE", "@element"~="T0816","DEVICE_RESTART/SHUTDOWN", "@element"~="T0817","DRIVE_BY_COMPROMISE", "@element"~="T0871","EXECUTION_THROUGH_API", "@element"~="T0819","EXPLOIT_PUBLIC_FACING_APPLICATION", "@element"~="T0860","WIRELESS_COMPROMISE", "@element"~="T0887","WIRELESS_SNIFFING", "@element"~="T0820","EXPLOITATION_FOR_EVASION", "@element"~="T0890","EXPLOITATION_FOR_PRIVILEGE_ESCALATION", "@element"~="T0866","EXPLOITATION_OF_REMOTE_SERVICES", "@element"~="T0822","EXTERNAL_REMOTE_SERVICES", "@element"~="T0823","GRAPHICAL_USER_INTERFACE", "@element"~="T0891","HARDCODED_CREDENTIALS", "@element"~="T0874","HOOKING", "@element"~="T0877","I/O_IMAGE", "@element"~="T0872","INDICATOR_REMOVAL_ON_HOST", "@element"~="T0883","INTERNET_ACCESSIBLE_DEVICE", "@element"~="T0867","LATERAL_TOOL_TRANSFER", "@element"~="T0826","LOSS_OF_AVAILABILITY", "@element"~="T0827","LOSS_OF_CONTROL", "@element"~="T0828","LOSS_OF_PRODUCTIVITY_AND_REVENUE", "@element"~="T0837","LOSS_OF_PROTECTION", "@element"~="T0880","LOSS_OF_SAFETY", "@element"~="T0829","LOSS_OF_VIEW", "@element"~="T0835","MANIPULATE_I/O_IMAGE", "@element"~="T0831","MANIPULATION_OF_CONTROL", "@element"~="T0832","MANIPULATION_OF_VIEW", "@element"~="T0849","MASQUERADING", "@element"~="T0838","MODIFY_ALARM_SETTINGS", "@element"~="T0821","MODIFY_CONTROLLER_TASKING", "@element"~="T0836","MODIFY_PARAMETER", "@element"~="T0889","MODIFY_PROGRAM", "@element"~="T0839","MODULE_FIRMWARE", "@element"~="T0801","MONITOR_PROCESS_STATE", "@element"~="T0834","NATIVE_API", "@element"~="T0840","NETWORK_CONNECTION_ENUMERATION", "@element"~="T0842","NETWORK_SNIFFING", "@element"~="T0861","POINT&TAG_IDENTIFICATION", "@element"~="T0843","PROGRAM_DOWNLOAD", "@element"~="T0845","PROGRAM_UPLOAD", "@element"~="T0873","PROJECT_FILE_INFECTION", "@element"~="T0886","REMOTE_SERVICES", "@element"~="T0846","REMOTE_SYSTEM_DISCOVERY", "@element"~="T0888","REMOTE_SYSTEM_INFORMATION_DISCOVERY", "@element"~="T0847","REPLICATION_THROUGH_REMOVABLE_MEDIA", "@element"~="T0848","ROGUE_MASTER", "@element"~="T0851","ROOTKIT", "@element"~="T0852","SCREEN_CAPTURE", "@element"~="T0853","SCRIPTING", "@element"~="T0881","SERVICE_STOP", "@element"~="T0865","SPEARPHISHING_ATTACHMENT", "@element"~="T0856","SPOOF_REPORTING_MESSAGE", "@element"~="T0869","STANDARD_APPLICATION_LAYER_PROTOCOL", "@element"~="T0862","SUPPLY_CHAIN_COMPROMISE", "@element"~="T0894","SYSTEM_BINARY_PROXY_EXECUTION", "@element"~="T0857","SYSTEM_FIRMWARE", "@element"~="T0882","THEFT_OF_OPERATIONAL_INFORMATION", "@element"~="T0864","TRANSIENT_CYBER_ASSET", "@element"~="T0855","UNAUTHORIZED_COMMAND_MESSAGE", "@element"~="T0863","USER_EXECUTION", "@element"~="T0859","VALID_ACCOUNTS","@element")), xdm.alert.category = ProductComponentName, xdm.event.original_event_type = ProviderName, xdm.network.http.method = if(ExtendedProperties_Http_Method = "GET", XDM_CONST.Http_Method_GET, ExtendedProperties_Http_Method = "POST", XDM_CONST.Http_Method_POST, ExtendedProperties_Http_Method = "PUT", XDM_CONST.Http_Method_PUT, ExtendedProperties_Http_Method = "OPTIONS", XDM_CONST.Http_Method_OPTIONS, ExtendedProperties_Http_Method = "CONNECT", XDM_CONST.Http_Method_CONNECT, ExtendedProperties_Http_Method = "ACL", XDM_CONST.Http_Method_ACL, ExtendedProperties_Http_Method = "BASELINE_CONTROL", XDM_CONST.Http_Method_BASELINE_CONTROL, ExtendedProperties_Http_Method = "BIND", XDM_CONST.Http_Method_BIND, ExtendedProperties_Http_Method = "CHECKIN", XDM_CONST.Http_Method_CHECKIN, ExtendedProperties_Http_Method = "CHECKOUT", XDM_CONST.Http_Method_CHECKOUT, ExtendedProperties_Http_Method = "COPY", XDM_CONST.Http_Method_COPY, ExtendedProperties_Http_Method = "DELETE", XDM_CONST.Http_Method_DELETE, ExtendedProperties_Http_Method = "HEAD", XDM_CONST.Http_Method_HEAD, ExtendedProperties_Http_Method = "LABEL", XDM_CONST.Http_Method_LABEL, ExtendedProperties_Http_Method = "LINK", XDM_CONST.Http_Method_LINK, ExtendedProperties_Http_Method = "LOCK", XDM_CONST.Http_Method_LOCK, ExtendedProperties_Http_Method = "MERGE", XDM_CONST.Http_Method_MERGE, ExtendedProperties_Http_Method = "MKACTIVITY", XDM_CONST.Http_Method_MKACTIVITY, ExtendedProperties_Http_Method = "MKCALENDAR", XDM_CONST.Http_Method_MKCALENDAR, ExtendedProperties_Http_Method = "MKCOL", XDM_CONST.Http_Method_MKCOL, ExtendedProperties_Http_Method = "MKREDIRECTREF", XDM_CONST.Http_Method_MKREDIRECTREF, ExtendedProperties_Http_Method = "MKWORKSPACE", XDM_CONST.Http_Method_MKWORKSPACE, ExtendedProperties_Http_Method = "MOVE", XDM_CONST.Http_Method_MOVE, ExtendedProperties_Http_Method = "ORDERPATCH", XDM_CONST.Http_Method_ORDERPATCH, ExtendedProperties_Http_Method = "PATCH", XDM_CONST.Http_Method_PATCH, ExtendedProperties_Http_Method = "PRI", XDM_CONST.Http_Method_PRI, ExtendedProperties_Http_Method = "PROPFIND", XDM_CONST.Http_Method_PROPFIND, ExtendedProperties_Http_Method = "PROPPATCH", XDM_CONST.Http_Method_PROPPATCH, ExtendedProperties_Http_Method = "REBIND", XDM_CONST.Http_Method_REBIND, ExtendedProperties_Http_Method = "REPORT", XDM_CONST.Http_Method_REPORT, ExtendedProperties_Http_Method = "SEARCH", XDM_CONST.Http_Method_SEARCH, ExtendedProperties_Http_Method = "TRACE", XDM_CONST.Http_Method_TRACE, ExtendedProperties_Http_Method = "UNBIND", XDM_CONST.Http_Method_UNBIND, ExtendedProperties_Http_Method = "UNCHECKOUT", XDM_CONST.Http_Method_UNCHECKOUT, ExtendedProperties_Http_Method = "UNLINK", XDM_CONST.Http_Method_UNLINK, ExtendedProperties_Http_Method = "UNLOCK", XDM_CONST.Http_Method_UNLOCK, ExtendedProperties_Http_Method = "UPDATE", XDM_CONST.Http_Method_UPDATE, ExtendedProperties_Http_Method = "UPDATEREDIRECTREF", XDM_CONST.Http_Method_UPDATEREDIRECTREF, ExtendedProperties_Http_Method = "VERSION_CONTROL", XDM_CONST.Http_Method_VERSION_CONTROL, null), xdm.target.host.os = Entities_host_OS;