Austin Songer
19 lines
819 B
YAML
19 lines
819 B
YAML
title: Microsoft 365 Defender Elasticsearch ecs mapping
|
|
order: 20
|
|
backends:
|
|
- es-qs
|
|
- es-rule
|
|
fieldmappings:
|
|
classification: microsoft.m365_defender.alerts.classification
|
|
determination: microsoft.m365_defender.alerts.determination
|
|
severity: microsoft.m365_defender.alerts.severity
|
|
status: microsoft.m365_defender.alerts.status
|
|
detectionSource: microsoft.m365_defender.alerts.detectionSource
|
|
threatFamilyName: microsoft.m365_defender.alerts.threatFamilyName
|
|
entityType: microsoft.m365_defender.alerts.entities.entityType
|
|
registryHive: microsoft.m365_defender.alerts.entities.registryHive
|
|
registryKey: microsoft.m365_defender.alerts.entities.registryKey
|
|
registryValueType: microsoft.m365_defender.alerts.entities.registryValueType
|
|
ipAddress: microsoft.m365_defender.alerts.entities.ipAddress
|
|
|