Start free trial Contact Sales

Microsoft fields

Microsoft Module

microsoft.defender_atp

Module for ingesting Microsoft Defender ATP.

microsoft.defender_atp.lastUpdateTime: The date and time (in UTC) the alert was last updated.

type: date

microsoft.defender_atp.resolvedTime: The date and time in which the status of the alert was changed to Resolved.

type: date

microsoft.defender_atp.incidentId: The Incident ID of the Alert.

type: keyword

microsoft.defender_atp.investigationId: The Investigation ID related to the Alert.

type: keyword

microsoft.defender_atp.investigationState: The current state of the Investigation.

type: keyword

microsoft.defender_atp.assignedTo: Owner of the alert.

type: keyword

microsoft.defender_atp.status: Specifies the current status of the alert. Possible values are: Unknown, New, InProgress and Resolved.

type: keyword

microsoft.defender_atp.classification: Specification of the alert. Possible values are: Unknown, FalsePositive, TruePositive.

type: keyword

microsoft.defender_atp.determination: Specifies the determination of the alert. Possible values are: NotAvailable, Apt, Malware, SecurityPersonnel, SecurityTesting, UnwantedSoftware, Other.

type: keyword

microsoft.defender_atp.threatFamilyName: Threat family.

type: keyword

microsoft.defender_atp.rbacGroupName: User group related to the alert

type: keyword

microsoft.defender_atp.evidence.domainName: Domain name related to the alert

type: keyword

microsoft.defender_atp.evidence.ipAddress: IP address involved in the alert

type: ip

microsoft.defender_atp.evidence.aadUserId: ID of the user involved in the alert

type: keyword

microsoft.defender_atp.evidence.accountName: Username of the user involved in the alert

type: keyword

microsoft.defender_atp.evidence.entityType: The type of evidence

type: keyword

microsoft.defender_atp.evidence.userPrincipalName: Principal name of the user involved in the alert

type: keyword

microsoft.m365_defender

Module for ingesting Microsoft Defender ATP.

microsoft.m365_defender.incidentId: Unique identifier to represent the incident.

type: keyword

microsoft.m365_defender.redirectIncidentId: Only populated in case an incident is being grouped together with another incident, as part of the incident processing logic.

type: keyword

microsoft.m365_defender.incidentName: Name of the Incident.

type: keyword

microsoft.m365_defender.determination: Specifies the determination of the incident. The property values are: NotAvailable, Apt, Malware, SecurityPersonnel, SecurityTesting, UnwantedSoftware, Other.

type: keyword

microsoft.m365_defender.investigationState: The current state of the Investigation.

type: keyword

microsoft.m365_defender.assignedTo: Owner of the alert.

type: keyword

microsoft.m365_defender.tags: Array of custom tags associated with an incident, for example to flag a group of incidents with a common characteristic.

type: keyword

microsoft.m365_defender.status: Specifies the current status of the alert. Possible values are: Unknown, New, InProgress and Resolved.

type: keyword

microsoft.m365_defender.classification: Specification of the alert. Possible values are: Unknown, FalsePositive, TruePositive.

type: keyword

microsoft.m365_defender.alerts.incidentId: Unique identifier to represent the incident this alert is associated with.

type: keyword

microsoft.m365_defender.alerts.resolvedTime: Time when alert was resolved.

type: date

microsoft.m365_defender.alerts.status: Categorize alerts (as New, Active, or Resolved).

type: keyword

microsoft.m365_defender.alerts.severity: The severity of the related alert.

type: keyword

microsoft.m365_defender.alerts.creationTime: Time when alert was first created.

type: date

microsoft.m365_defender.alerts.lastUpdatedTime: Time when alert was last updated.

type: date

microsoft.m365_defender.alerts.investigationId: The automated investigation id triggered by this alert.

type: keyword

microsoft.m365_defender.alerts.userSid: The SID of the related user

type: keyword

microsoft.m365_defender.alerts.detectionSource: The service that initially detected the threat.

type: keyword

microsoft.m365_defender.alerts.classification: The specification for the incident. The property values are: Unknown, FalsePositive, TruePositive or null.

type: keyword

microsoft.m365_defender.alerts.investigationState: Information on the investigation’s current status.

type: keyword

microsoft.m365_defender.alerts.determination: Specifies the determination of the incident. The property values are: NotAvailable, Apt, Malware, SecurityPersonnel, SecurityTesting, UnwantedSoftware, Other or null

type: keyword

microsoft.m365_defender.alerts.assignedTo: Owner of the incident, or null if no owner is assigned.

type: keyword

microsoft.m365_defender.alerts.actorName: The activity group, if any, the associated with this alert.

type: keyword

microsoft.m365_defender.alerts.threatFamilyName: Threat family associated with this alert.

type: keyword

microsoft.m365_defender.alerts.mitreTechniques: The attack techniques, as aligned with the MITRE ATT&CK™ framework.

type: keyword

microsoft.m365_defender.alerts.entities.entityType: Entities that have been identified to be part of, or related to, a given alert. The properties values are: User, Ip, Url, File, Process, MailBox, MailMessage, MailCluster, Registry.

type: keyword

microsoft.m365_defender.alerts.entities.accountName: Account name of the related user.

type: keyword

microsoft.m365_defender.alerts.entities.mailboxDisplayName: The display name of the related mailbox.

type: keyword

microsoft.m365_defender.alerts.entities.mailboxAddress: The mail address of the related mailbox.

type: keyword

microsoft.m365_defender.alerts.entities.clusterBy: A list of metadata if the entityType is MailCluster.

type: keyword

microsoft.m365_defender.alerts.entities.sender: The sender for the related email message.

type: keyword

microsoft.m365_defender.alerts.entities.recipient: The recipient for the related email message.

type: keyword

microsoft.m365_defender.alerts.entities.subject: The subject for the related email message.

type: keyword

microsoft.m365_defender.alerts.entities.deliveryAction: The delivery status for the related email message.

type: keyword

microsoft.m365_defender.alerts.entities.securityGroupId: The Security Group ID for the user related to the email message.

type: keyword

microsoft.m365_defender.alerts.entities.securityGroupName: The Security Group Name for the user related to the email message.

type: keyword

microsoft.m365_defender.alerts.entities.registryHive: Reference to which Hive in registry the event is related to, if eventType is registry. Example: HKEY_LOCAL_MACHINE.

type: keyword

microsoft.m365_defender.alerts.entities.registryKey: Reference to the related registry key to the event.

type: keyword

microsoft.m365_defender.alerts.entities.registryValueType: Value type of the registry key/value pair related to the event.

type: keyword

microsoft.m365_defender.alerts.entities.deviceId: The unique ID of the device related to the event.

type: keyword

microsoft.m365_defender.alerts.entities.ipAddress: The related IP address to the event.

type: keyword

microsoft.m365_defender.alerts.devices: The devices related to the investigation.

type: flattened