Coletar registros do Microsoft Defender para Ponto de Extremidade

Compatível com:

Google SecOps SIEM

Observação: esse recurso é coberto pelos Termos de ofertas pré-disponibilidade geral dos Termos específicos do serviço de operações de segurança do Google. Os recursos pré-GA podem ter suporte limitado, e as mudanças realizadas podem não ser compatíveis com outras versões pré-GA. Para mais informações, consulte as diretrizes do serviço de suporte técnico do Google Security Operations e os Termos específicos do serviço do Google Security Operations.

Este documento descreve como coletar registros do Microsoft Defender para Endpoint configurando um feed de operações de segurança do Google e como os campos de registro são mapeados para os campos do modelo de dados unificado (UDM, na sigla em inglês) do Google SecOps.

Para mais informações, consulte Ingestão de dados no Google SecOps.

Uma implantação típica consiste no Microsoft Defender para endpoint e no feed do Google SecOps configurado para enviar registros ao Google SecOps. Sua implantação pode ser diferente da implantação típica descrita neste documento. A implantação contém os seguintes componentes:

• Microsoft Defender para Ponto de Extremidade: a plataforma que coleta registros.

• Armazenamento do Azure: a plataforma que armazena registros.

• Feed do Google SecOps: o feed do Google SecOps que busca registros do Microsoft Defender para endpoint e grava registros no Google SecOps.

• Google SecOps: a plataforma que retém e analisa os registros do Microsoft Defender para Endpoint.

Um rótulo de transferência identifica o analisador que normaliza os dados de registro brutos para o formato estruturado do UDM. As informações neste documento se aplicam ao analisador com o rótulo de transferência MICROSOFT_DEFENDER_ENDPOINT.

Antes de começar

• Defina o fuso horário como UTC em todos os sistemas na arquitetura de implantação.
• Verifique se você atende aos pré-requisitos para usar o Microsoft Defender para Ponto de Extremidade. Para mais informações, consulte os pré-requisitos do Microsoft Defender XDR.
• Verifique se você configurou o Microsoft Defender para Ponto de Extremidade.
• Configure uma conta de armazenamento no seu locatário.

Configurar o Microsoft Defender para Ponto de Extremidade

1. Faça login em security.microsoft.com como administrador global ou de segurança.
2. No painel à esquerda, clique em Configurações.
3. Selecione a guia Microsoft Defender XDR.
4. Selecione API Streaming na seção geral e clique em Adicionar.
5. Selecione Encaminhar eventos para o Azure Storage.
6. Acesse a conta de armazenamento que você quer usar.
7. Selecione Visão geral > Visualização JSON e insira o ID do recurso.
8. Depois de inserir o ID do recurso, selecione todos os tipos de dados necessários.
9. Clique em Salvar.

Configurar um feed no Google SecOps para processar os registros do Microsoft Defender para Endpoints

1. Acesse Configurações do SIEM > Feeds.
2. Clique em Adicionar novo.
3. No campo Nome do feed, insira um nome para o feed (por exemplo, Logs do MS Defender).
4. Selecione Armazenamento de Blobs do Microsoft Azure como o Tipo de origem.
5. Selecione Microsoft Defender para ponto de extremidade como o Tipo de registro.
6. Clique em Próximo.
7. Configure os seguintes parâmetros de entrada:
   • URI do Azure: o URI que aponta para um blob ou contêiner do Armazenamento de Blobs do Azure.
   • URI é: o tipo de objeto indicado pelo URI.
   • Opção de exclusão da origem: se você quer excluir arquivos ou diretórios após a transferência.
   • Selecione Chave compartilhada ou Token SAS.
   • Chave/token: a chave compartilhada ou o token SAS para acessar os recursos do Azure.
8. Clique em Próxima e em Enviar.

Se você encontrar problemas ao importar os logs do Microsoft Defender para endpoint, entre em contato com o suporte do Google SecOps.

Tipos de registro do Microsoft Defender para Ponto de Extremidade com suporte

O analisador do Microsoft Defender para Ponto de Extremidade oferece suporte às seguintes tabelas:

• AlertEvidence
• AlertInfo
• DeviceAlertEvents
• DeviceEvents
• DeviceFileCertificateInfo
• DeviceFileEvents
• DeviceIdentityLogonEvents
• DeviceImageLoadEvents
• DeviceInfo
• DeviceLogonEvents
• DeviceNetworkEvents
• DeviceNetworkInfo
• DeviceProcessEvents
• DeviceRegistryEvents
• DeviceTvmInfoGathering
• DeviceTvmInfoGatheringKB
• DeviceTvmSecureConfigurationAssessment
• DeviceTvmSecureConfigurationAssessmentKB
• DeviceTvmSoftwareEvidenceBeta
• DeviceTvmSoftwareInventory
• DeviceTvmSoftwareVulnerabilities
• DeviceTvmSoftwareVulnerabilitiesKB
• EmailAttachmentInfo
• EmailEvents
• EmailPostDeliveryEvents
• EmailUrlInfo
• IdentityInfo

Referência do mapeamento de campo

Esta seção explica como o analisador do Google Security Operations mapeia os campos do Microsoft Defender para endpoint para os campos do UDM do Google Security Operations.

Referência de mapeamento de campo: MICROSOFT DEFENDER ENDPOINT - Common Fields for UDM Event Model

A tabela a seguir lista os campos de registro comuns do tipo MICROSOFT_DEFENDER_ENDPOINT e os campos correspondentes do UDM:

Common log field	UDM mapping	Logic
time	metadata.collected_timestamp
category	metadata.product_event_type
	metadata.product_name	The metadata.product_name UDM field is set to Microsoft Defender for Endpoint.
	metadata.vendor_name	The metadata.vendor_name UDM field is set to Microsoft.
Tenant	observer.resource_ancestors.name
tenantId	observer.resource_ancestors.product_object_id
operationName	additional.fields[operation_name]

Referência de mapeamento de campo: MICROSOFT DEFENDER ENDPOINT - Common Fields for UDM Entity Model

A tabela a seguir lista os campos de registro comuns do tipo MICROSOFT_DEFENDER_ENDPOINT e os campos correspondentes do UDM:

Common log field	UDM mapping	Logic
	metadata.vendor_name	The metadata.vendor_name UDM field is set to Microsoft.
	metadata.product_name	The metadata.product_name UDM field is set to Microsoft Defender for Endpoint.
time	metadata.collected_timestamp
tenantId	relations.entity.resource.product_object_id
operationName	additional.fields[operation_name]
category	metadata.description
Tenant	relations.entity.resource.name
	relations.entity_type	The relations.entity_type UDM field is set to RESOURCE.
	relations.relationship	The relations.relationship UDM field is set to MEMBER.
	relations.direction	The relations.direction UDM field is set to UNIDIRECTIONAL.

Referência de mapeamento de campo: identificador de evento de DeviceEvents para tipo de evento

A tabela a seguir lista os tipos de ação de registro DeviceEvents e os tipos de evento do UDM correspondentes.

Event Identifier	Event Type
UsbDriveDriveLetterChanged	DEVICE_CONFIG_UPDATE
AppControlAppInstallationAudited	SCAN_HOST
AsrExecutableOfficeContentAudited	SCAN_HOST
ShellLinkCreateFileEvent	FILE_CREATION
FileTimestampModificationEvent	FILE_MODIFICATION
PlistPropertyModified	FILE_MODIFICATION
SensitiveFileRead	FILE_READ
AsrUntrustedExecutableAudited	SCAN_HOST
AsrUntrustedExecutableBlocked	SCAN_HOST
DlpPocPrintJob	FILE_UNCATEGORIZED
RemovableStorageFileEvent	FILE_UNCATEGORIZED
DpapiAccessed	GENERIC_EVENT
ScreenshotTaken	GENERIC_EVENT
SecurityGroupCreated	GROUP_CREATION
SecurityGroupDeleted	GROUP_DELETION
UserAccountAddedToLocalGroup	GROUP_MODIFICATION
UserAccountRemovedFromLocalGroup	GROUP_MODIFICATION
ExploitGuardNetworkProtectionAudited	SCAN_HOST
ExploitGuardNetworkProtectionBlocked	SCAN_HOST
FirewallInboundConnectionBlocked	NETWORK_CONNECTION
FirewallInboundConnectionToAppBlocked	NETWORK_CONNECTION
FirewallOutboundConnectionBlocked	NETWORK_CONNECTION
RemoteDesktopConnection	NETWORK_CONNECTION
RemoteWmiOperation	NETWORK_CONNECTION
UntrustedWifiConnection	NETWORK_CONNECTION
DnsQueryRequest	NETWORK_DNS
DnsQueryResponse	NETWORK_DNS
NetworkShareObjectAdded	NETWORK_UNCATEGORIZED
AppGuardBrowseToUrl	SCAN_HOST
BrowserLaunchedToOpenUrl	NETWORK_UNCATEGORIZED
NetworkProtectionUserBypassEvent	NETWORK_UNCATEGORIZED
NetworkShareObjectAccessChecked	NETWORK_UNCATEGORIZED
NetworkShareObjectDeleted	NETWORK_UNCATEGORIZED
NetworkShareObjectModified	NETWORK_UNCATEGORIZED
AsrOfficeProcessInjectionAudited	SCAN_HOST
AppGuardCreateContainer	SCAN_HOST
AppGuardLaunchedWithUrl	SCAN_HOST
AsrAdobeReaderChildProcessAudited	SCAN_HOST
AsrAdobeReaderChildProcessBlocked	SCAN_HOST
AsrExecutableEmailContentAudited	SCAN_HOST
AsrOfficeChildProcessAudited	SCAN_HOST
AsrOfficeCommAppChildProcessAudited	SCAN_HOST
AsrPsexecWmiChildProcessAudited	SCAN_HOST
AsrScriptExecutableDownloadAudited	SCAN_HOST
AsrUntrustedUsbProcessAudited	SCAN_HOST
ExploitGuardChildProcessAudited	SCAN_HOST
ExploitGuardLowIntegrityImageAudited	SCAN_HOST
PowerShellCommand	PROCESS_LAUNCH
ProcessCreatedUsingWmiQuery	PROCESS_LAUNCH
QueueUserApcRemoteApiCall	PROCESS_LAUNCH
GetClipboardData	STATUS_UPDATE
OpenProcessApiCall	PROCESS_OPEN
ScriptContent	PROCESS_LAUNCH
AppControlAppInstallationBlocked	SCAN_HOST
AppGuardSuspendContainer	SCAN_HOST
AppGuardStopContainer	SCAN_HOST
AppLockerBlockExecutable	PROCESS_UNCATEGORIZED
AsrObfuscatedScriptAudited	SCAN_HOST
AsrObfuscatedScriptBlocked	SCAN_HOST
AsrOfficeChildProcessBlocked	SCAN_HOST
AsrOfficeProcessInjectionBlocked	SCAN_HOST
AsrPsexecWmiChildProcessBlocked	SCAN_HOST
AsrScriptExecutableDownloadBlocked	SCAN_HOST
AsrUntrustedUsbProcessBlocked	SCAN_HOST
ExploitGuardChildProcessBlocked	SCAN_HOST
ExploitGuardLowIntegrityImageBlocked	SCAN_HOST
ExploitGuardSharedBinaryAudited	SCAN_HOST
ExploitGuardSharedBinaryBlocked	SCAN_HOST
MemoryRemoteProtect	PROCESS_UNCATEGORIZED
NamedPipeEvent	PROCESS_UNCATEGORIZED
NtAllocateVirtualMemoryApiCall	PROCESS_UNCATEGORIZED
NtAllocateVirtualMemoryRemoteApiCall	PROCESS_UNCATEGORIZED
NtMapViewOfSectionRemoteApiCall	PROCESS_UNCATEGORIZED
NtProtectVirtualMemoryApiCall	PROCESS_UNCATEGORIZED
ProcessPrimaryTokenModified	PROCESS_UNCATEGORIZED
PTraceDetected	PROCESS_UNCATEGORIZED
ReadProcessMemoryApiCall	PROCESS_UNCATEGORIZED
SetThreadContextRemoteApiCall	PROCESS_UNCATEGORIZED
WriteProcessMemoryApiCall	PROCESS_UNCATEGORIZED
WriteToLsassProcessMemory	PROCESS_UNCATEGORIZED
AsrOfficeCommAppChildProcessBlocked	SCAN_HOST
AppControlCIScriptAudited	SCAN_HOST
AppControlCIScriptBlocked	SCAN_HOST
AppControlCodeIntegrityImageAudited	SCAN_HOST
AppControlCodeIntegrityImageRevoked	SCAN_HOST
AppControlCodeIntegrityOriginAllowed	SCAN_HOST
AppControlCodeIntegrityOriginAudited	SCAN_HOST
AppControlCodeIntegrityOriginBlocked	SCAN_HOST
AppControlScriptAudited	SCAN_HOST
AppControlScriptBlocked	SCAN_HOST
AsrExecutableEmailContentBlocked	SCAN_HOST
SafeDocFileScan	SCAN_FILE
AntivirusDefinitionsUpdated	SCAN_HOST
AntivirusDefinitionsUpdateFailed	SCAN_HOST
AntivirusDetection	SCAN_HOST
AntivirusDetectionActionType	SCAN_HOST
AntivirusEmergencyUpdatesInstalled	SCAN_HOST
AntivirusError	SCAN_HOST
AntivirusMalwareActionFailed	SCAN_HOST
AntivirusMalwareBlocked	SCAN_HOST
AntivirusReport	SCAN_HOST
AntivirusScanCancelled	SCAN_HOST
AntivirusScanCompleted	SCAN_HOST
AntivirusScanFailed	SCAN_HOST
AntivirusTroubleshootModeEvent	SCAN_HOST
AppControlCodeIntegrityDriverRevoked	SCAN_HOST
AppControlCodeIntegrityPolicyAudited	SCAN_HOST
AppControlCodeIntegrityPolicyBlocked	SCAN_HOST
AppControlCodeIntegrityPolicyLoaded	SCAN_HOST
AppControlCodeIntegritySigningInformation	SCAN_HOST
AppControlExecutableAudited	SCAN_HOST
AppControlExecutableBlocked	SCAN_HOST
AppControlPackagedAppAudited	SCAN_HOST
AppControlPackagedAppBlocked	SCAN_HOST
AccountCheckedForBlankPassword	SCAN_UNCATEGORIZED
SmartScreenAppWarning	SCAN_UNCATEGORIZED
SmartScreenExploitWarning	SCAN_HOST
SmartScreenUrlWarning	SCAN_UNCATEGORIZED
SmartScreenUserOverride	SCAN_UNCATEGORIZED
ScheduledTaskCreated	SCHEDULED_TASK_CREATION
ScheduledTaskDeleted	SCHEDULED_TASK_DELETION
ScheduledTaskDisabled	SCHEDULED_TASK_DISABLE
ScheduledTaskEnabled	SCHEDULED_TASK_ENABLE
ScheduledTaskUpdated	SCHEDULED_TASK_MODIFICATION
ServiceInstalled	SERVICE_CREATION
DirectoryServiceObjectCreated	SERVICE_MODIFICATION
DirectoryServiceObjectModified	SERVICE_MODIFICATION
AuditPolicyModification	SERVICE_MODIFICATION
CreateRemoteThreadApiCall	PROCESS_UNCATEGORIZED
CredentialsBackup	SERVICE_START
FirewallServiceStopped	SERVICE_STOP
BitLockerAuditCompleted	SERVICE_UNSPECIFIED
AppControlPolicyApplied	SCAN_HOST
AppGuardResumeContainer	SCAN_HOST
AppLockerBlockPackagedApp	STATUS_UPDATE
AppLockerBlockPackagedAppInstallation	STATUS_UPDATE
AppLockerBlockScript	STATUS_UPDATE
AsrExecutableOfficeContentBlocked	SCAN_HOST
AsrLsassCredentialTheftAudited	SCAN_HOST
AsrLsassCredentialTheftBlocked	SCAN_HOST
AsrOfficeMacroWin32ApiCallsAudited	SCAN_HOST
AsrOfficeMacroWin32ApiCallsBlocked	SCAN_HOST
AsrPersistenceThroughWmiAudited	SCAN_HOST
AsrPersistenceThroughWmiBlocked	SCAN_HOST
AsrRansomwareAudited	SCAN_HOST
AsrRansomwareBlocked	SCAN_HOST
AsrVulnerableSignedDriverAudited	SCAN_HOST
AsrVulnerableSignedDriverBlocked	SCAN_HOST
BluetoothPolicyTriggered	STATUS_UPDATE
ClrUnbackedModuleLoaded	PROCESS_MODULE_LOAD
ControlFlowGuardViolation	STATUS_UPDATE
DeviceBootAttestationInfo	STATUS_UPDATE
DriverLoad	PROCESS_MODULE_LOAD
ExploitGuardEafViolationAudited	SCAN_HOST
ExploitGuardEafViolationBlocked	SCAN_HOST
ExploitGuardIafViolationAudited	SCAN_HOST
ExploitGuardIafViolationBlocked	SCAN_HOST
ExploitGuardNonMicrosoftSignedAudited	SCAN_HOST
ExploitGuardNonMicrosoftSignedBlocked	SCAN_HOST
ExploitGuardRopExploitAudited	SCAN_HOST
ExploitGuardRopExploitBlocked	SCAN_HOST
ExploitGuardWin32SystemCallAudited	SCAN_HOST
ExploitGuardWin32SystemCallBlocked	SCAN_HOST
GetAsyncKeyStateApiCall	STATUS_UPDATE
OtherAlertRelatedActivity	STATUS_UPDATE
PnpDeviceAllowed	DEVICE_CONFIG_UPDATE
PnpDeviceBlocked	STATUS_UPDATE
PnpDeviceConnected	STATUS_UPDATE
PrintJobBlocked	STATUS_UPDATE
RemovableStoragePolicyTriggered	STATUS_UPDATE
SecurityLogCleared	SYSTEM_AUDIT_LOG_WIPE
TvmAxonTelemetryEvent	STATUS_UPDATE
UsbDriveMount	DEVICE_CONFIG_UPDATE
UsbDriveMounted	DEVICE_CONFIG_UPDATE
UsbDriveUnmount	DEVICE_CONFIG_UPDATE
UsbDriveUnmounted	DEVICE_CONFIG_UPDATE
WmiBindEventFilterToConsumer	STATUS_UPDATE
TamperingAttempt	SETTING_MODIFICATION
PasswordChangeAttempt	USER_CHANGE_PASSWORD
LogonRightsSettingEnabled	USER_CHANGE_PERMISSIONS
UserAccountCreated	USER_CREATION
UserAccountDeleted	USER_DELETION
LdapSearch	STATUS_UPDATE
ControlledFolderAccessViolationAudited	SCAN_FILE
ControlledFolderAccessViolationBlocked	SCAN_FILE
ExploitGuardAcgAudited	SCAN_HOST
ExploitGuardAcgEnforced	SCAN_HOST
UserAccountModified	USER_UNCATEGORIZED

Referência de mapeamento de campo: MICROSOFT DEFENDER ENDPOINT - DeviceEvents

A tabela a seguir lista os campos de registro do tipo DeviceEvents e os campos correspondentes do UDM:

Log field	UDM mapping	Logic
properties.Timestamp	metadata.event_timestamp
properties.ActionType	metadata.event_type
properties.ReportId	metadata.product_log_id
properties.LogonId	network.session_id
properties.DeviceId	principal.asset_id	The principal.asset_id is set to DeviceID:%{properties.DeviceId}.
properties.InitiatingProcessAccountDomain	principal.administrative_domain	If the properties.ActionType log field contains one of the following values, and the properties.InitiatingProcessAccountDomain log field value is not empty, then the properties.InitiatingProcessAccountDomain log field is mapped to the target.administrative_domain UDM field. PasswordChangeAttempt UserAccountCreated UserAccountDeleted Else, if the properties.InitiatingProcessAccountDomain log field value is not empty, then the properties.InitiatingProcessAccountDomain log field is mapped to the principal.administrative_domain UDM field.
properties.AccountDomain	principal.administrative_domain	If the properties.ActionType log field contains one of the following values, and the properties.InitiatingProcessAccountDomain log field value is empty, then the properties.AccountDomain log field is mapped to the target.administrative_domain UDM field. PasswordChangeAttempt UserAccountCreated UserAccountDeleted Else, if the properties.InitiatingProcessAccountDomain log field value is empty, then the properties.AccountDomain log field is mapped to the principal.administrative_domain UDM field.
properties.DeviceName	principal.hostname
properties.LocalIP	principal.ip
properties.FileOriginIP	principal.ip
properties.LocalPort	principal.port
properties.InitiatingProcessCommandLine	principal.process.command_line
properties.InitiatingProcessFolderPath	principal.process.file.full_path	If the properties.InitiatingProcessFolderPath log field value matches the regular expression pattern the properties.InitiatingProcessFileName log field value, then the properties.InitiatingProcessFolderPath log field is mapped to the principal.process.file.full_path UDM field. Else, the principal.process.file.full_path is set to %{properties.InitiatingProcessFolderPath}/%{properties.InitiatingProcessFileName}.
properties.InitiatingProcessMD5	principal.process.file.md5	If the properties.InitiatingProcessMD5 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.InitiatingProcessMD5 log field is mapped to the principal.process.file.md5 UDM field.
properties.InitiatingProcessFileName	principal.process.file.names
properties.InitiatingProcessSHA1	principal.process.file.sha1	If the properties.InitiatingProcessSHA1 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.InitiatingProcessSHA1 log field is mapped to the principal.process.file.sha1 UDM field.
properties.InitiatingProcessSHA256	principal.process.file.sha256	If the properties.InitiatingProcessSHA256 log field value matches the regular expression pattern ^[a-f0-9]{64}$, then the properties.InitiatingProcessSHA256 log field is mapped to the principal.process.file.sha256 UDM field.
properties.InitiatingProcessFileSize	principal.process.file.size
properties.InitiatingProcessParentFileName	principal.process.parent_process.file.names
properties.InitiatingProcessParentId	principal.process.parent_process.pid
properties.InitiatingProcessId	principal.process.pid
properties.FileOriginUrl	principal.url
properties.InitiatingProcessAccountObjectId	principal.user.product_object_id
properties.InitiatingProcessAccountUpn	principal.user.user_display_name
properties.InitiatingProcessAccountName	principal.user.userid	If the properties.ActionType log field contains one of the following values, and the properties.InitiatingProcessAccountName log field value is not empty, then the properties.InitiatingProcessAccountName log field is mapped to the target.user.userid UDM field. PasswordChangeAttempt UserAccountCreated UserAccountDeleted Else, if the properties.InitiatingProcessAccountName log field value is not empty, then the properties.InitiatingProcessAccountName log field is mapped to the principal.user.userid UDM field.
properties.AccountName	principal.user.userid	If the properties.ActionType log field contains one of the following values, and the properties.InitiatingProcessAccountName log field value is empty, then the properties.AccountName log field is mapped to the target.user.userid UDM field. PasswordChangeAttempt UserAccountCreated UserAccountDeleted Else, if the properties.InitiatingProcessAccountName log field value is empty, then the properties.AccountName log field is mapped to the principal.user.userid UDM field.
properties.InitiatingProcessAccountSid	principal.user.windows_sid	If the properties.ActionType log field contains one of the following values, and the properties.InitiatingProcessAccountSid log field value is not empty, then the properties.InitiatingProcessAccountSid log field is mapped to the target.user.windows_sid UDM field. PasswordChangeAttempt UserAccountCreated UserAccountDeleted Else, if the properties.InitiatingProcessAccountSid log field value is not empty, then the properties.InitiatingProcessAccountSid log field is mapped to the principal.user.windows_sid UDM field.
properties.AccountSid	principal.user.windows_sid	If the properties.ActionType log field contains one of the following values, and the properties.InitiatingProcessAccountSid log field value is empty, then the properties.AccountSid log field is mapped to the target.user.windows_sid UDM field. PasswordChangeAttempt UserAccountCreated UserAccountDeleted Else, if the properties.InitiatingProcessAccountSid log field value is empty, then the properties.AccountSid log field is mapped to the principal.user.windows_sid UDM field.
properties.ActionType	security_result.action	If the properties.ActionType log field value matches the regular expression pattern (?i)Allow, then the security_result.action UDM field is set to ALLOW. Else if the properties.ActionType log field value matches the regular expression pattern (?i)Block, then the security_result.action UDM field is set to BLOCK. Else if the properties.ActionType log field value matches the regular expression pattern (?i)Fail, then the security_result.action UDM field is set to FAIL.
properties.FolderPath	target.file.full_path	If the properties.RemoteDeviceName log field value contain one of the following values ProcessCreatedUsingWmiQuery OpenProcessApiCall MemoryRemoteProtect NtAllocateVirtualMemoryApiCall NtAllocateVirtualMemoryRemoteApiCall NtMapViewOfSectionRemoteApiCall NtProtectVirtualMemoryApiCall ProcessPrimaryTokenModified ReadProcessMemoryApiCall SetThreadContextRemoteApiCall WriteProcessMemoryApiCall WriteToLsassProcessMemory CreateRemoteThreadApiCall AsrOfficeProcessInjectionAudited AsrAdobeReaderChildProcessAudited AsrAdobeReaderChildProcessBlocked AsrOfficeChildProcessAudited AsrOfficeCommAppChildProcessAudited AsrPsexecWmiChildProcessAudited AsrUntrustedUsbProcessAudited ExploitGuardChildProcessAudited AsrOfficeChildProcessBlocked AsrOfficeProcessInjectionBlocked AsrPsexecWmiChildProcessBlocked AsrUntrustedUsbProcessBlocked ExploitGuardChildProcessBlocked AsrOfficeCommAppChildProcessBlocked and if the properties.FolderPath log field value matches the regular expression pattern the properties.FileName log field value then, properties.FolderPath log field is mapped to the target.process.file.full_path UDM field. Else, %{properties.FolderPath}\%{properties.FileName} log field is mapped to the target.process.file.full_path UDM field. Else, if the properties.FolderPath log field value matches the regular expression pattern the properties.FileName log field value then, properties.FolderPath log field is mapped to the target.file.full_path UDM field. Else, %{properties.FolderPath}\%{properties.FileName} log field is mapped to the target.file.full_path UDM field.
properties.MD5	target.file.md5	If the properties.RemoteDeviceName log field value contain one of the following values ProcessCreatedUsingWmiQuery OpenProcessApiCall MemoryRemoteProtect NtAllocateVirtualMemoryApiCall NtAllocateVirtualMemoryRemoteApiCall NtMapViewOfSectionRemoteApiCall NtProtectVirtualMemoryApiCall ProcessPrimaryTokenModified ReadProcessMemoryApiCall SetThreadContextRemoteApiCall WriteProcessMemoryApiCall WriteToLsassProcessMemory CreateRemoteThreadApiCall AsrOfficeProcessInjectionAudited AsrAdobeReaderChildProcessAudited AsrAdobeReaderChildProcessBlocked AsrOfficeChildProcessAudited AsrOfficeCommAppChildProcessAudited AsrPsexecWmiChildProcessAudited AsrUntrustedUsbProcessAudited ExploitGuardChildProcessAudited AsrOfficeChildProcessBlocked AsrOfficeProcessInjectionBlocked AsrPsexecWmiChildProcessBlocked AsrUntrustedUsbProcessBlocked ExploitGuardChildProcessBlocked AsrOfficeCommAppChildProcessBlocked and if the properties.MD5 log field value matches the regular expression pattern ^[0-9a-f]+$ then, properties.MD5 log field is mapped to the target.process.file.md5 UDM field. Else, if the properties.MD5 log field value matches the regular expression pattern ^[0-9a-f]+$ then, properties.MD5 log field is mapped to the target.file.md5 UDM field.
properties.FileName	target.file.names	If the properties.RemoteDeviceName log field value contain one of the following values ProcessCreatedUsingWmiQuery OpenProcessApiCall MemoryRemoteProtect NtAllocateVirtualMemoryApiCall NtAllocateVirtualMemoryRemoteApiCall NtMapViewOfSectionRemoteApiCall NtProtectVirtualMemoryApiCall ProcessPrimaryTokenModified ReadProcessMemoryApiCall SetThreadContextRemoteApiCall WriteProcessMemoryApiCall WriteToLsassProcessMemory CreateRemoteThreadApiCall AsrOfficeProcessInjectionAudited AsrAdobeReaderChildProcessAudited AsrAdobeReaderChildProcessBlocked AsrOfficeChildProcessAudited AsrOfficeCommAppChildProcessAudited AsrPsexecWmiChildProcessAudited AsrUntrustedUsbProcessAudited ExploitGuardChildProcessAudited AsrOfficeChildProcessBlocked AsrOfficeProcessInjectionBlocked AsrPsexecWmiChildProcessBlocked AsrUntrustedUsbProcessBlocked ExploitGuardChildProcessBlocked AsrOfficeCommAppChildProcessBlocked and if the properties.MD5 log field value matches the regular expression pattern ^[0-9a-f]+$ then, properties.FileName log field is mapped to the target.process.file.names UDM field. Else, if the properties.MD5 log field value matches the regular expression pattern ^[0-9a-f]+$ then, properties.FileName log field is mapped to the target.file.names UDM field.
properties.SHA1	target.file.sha1	If the properties.RemoteDeviceName log field value contain one of the following values ProcessCreatedUsingWmiQuery OpenProcessApiCall MemoryRemoteProtect NtAllocateVirtualMemoryApiCall NtAllocateVirtualMemoryRemoteApiCall NtMapViewOfSectionRemoteApiCall NtProtectVirtualMemoryApiCall ProcessPrimaryTokenModified ReadProcessMemoryApiCall SetThreadContextRemoteApiCall WriteProcessMemoryApiCall WriteToLsassProcessMemory CreateRemoteThreadApiCall AsrOfficeProcessInjectionAudited AsrAdobeReaderChildProcessAudited AsrAdobeReaderChildProcessBlocked AsrOfficeChildProcessAudited AsrOfficeCommAppChildProcessAudited AsrPsexecWmiChildProcessAudited AsrUntrustedUsbProcessAudited ExploitGuardChildProcessAudited AsrOfficeChildProcessBlocked AsrOfficeProcessInjectionBlocked AsrPsexecWmiChildProcessBlocked AsrUntrustedUsbProcessBlocked ExploitGuardChildProcessBlocked AsrOfficeCommAppChildProcessBlocked and if the properties.SHA1 log field value matches the regular expression pattern ^[0-9a-f]+$ then, properties.SHA1 log field is mapped to the target.process.file.sha1 UDM field. Else, if the properties.SHA1 log field value matches the regular expression pattern ^[0-9a-f]+$ then, properties.SHA1 log field is mapped to the target.file.sha1 UDM field.
properties.SHA256	target.file.sha256	If the properties.RemoteDeviceName log field value contain one of the following values ProcessCreatedUsingWmiQuery OpenProcessApiCall MemoryRemoteProtect NtAllocateVirtualMemoryApiCall NtAllocateVirtualMemoryRemoteApiCall NtMapViewOfSectionRemoteApiCall NtProtectVirtualMemoryApiCall ProcessPrimaryTokenModified ReadProcessMemoryApiCall SetThreadContextRemoteApiCall WriteProcessMemoryApiCall WriteToLsassProcessMemory CreateRemoteThreadApiCall AsrOfficeProcessInjectionAudited AsrAdobeReaderChildProcessAudited AsrAdobeReaderChildProcessBlocked AsrOfficeChildProcessAudited AsrOfficeCommAppChildProcessAudited AsrPsexecWmiChildProcessAudited AsrUntrustedUsbProcessAudited ExploitGuardChildProcessAudited AsrOfficeChildProcessBlocked AsrOfficeProcessInjectionBlocked AsrPsexecWmiChildProcessBlocked AsrUntrustedUsbProcessBlocked ExploitGuardChildProcessBlocked AsrOfficeCommAppChildProcessBlocked and if the properties.SHA256 log field value matches the regular expression pattern ^[a-f0-9]{64}$ then, properties.SHA256 log field is mapped to the target.process.file.sha256 UDM field. Else, if the properties.SHA256 log field value matches the regular expression pattern ^[a-f0-9]{64}$ then, properties.SHA256 log field is mapped to the target.file.sha256 UDM field.
properties.FileSize	target.file.size	If the properties.RemoteDeviceName log field value contain one of the following values ProcessCreatedUsingWmiQuery OpenProcessApiCall MemoryRemoteProtect NtAllocateVirtualMemoryApiCall NtAllocateVirtualMemoryRemoteApiCall NtMapViewOfSectionRemoteApiCall NtProtectVirtualMemoryApiCall ProcessPrimaryTokenModified ReadProcessMemoryApiCall SetThreadContextRemoteApiCall WriteProcessMemoryApiCall WriteToLsassProcessMemory CreateRemoteThreadApiCall AsrOfficeProcessInjectionAudited AsrAdobeReaderChildProcessAudited AsrAdobeReaderChildProcessBlocked AsrOfficeChildProcessAudited AsrOfficeCommAppChildProcessAudited AsrPsexecWmiChildProcessAudited AsrUntrustedUsbProcessAudited ExploitGuardChildProcessAudited AsrOfficeChildProcessBlocked AsrOfficeProcessInjectionBlocked AsrPsexecWmiChildProcessBlocked AsrUntrustedUsbProcessBlocked ExploitGuardChildProcessBlocked AsrOfficeCommAppChildProcessBlocked and if the properties.MD5 log field value matches the regular expression pattern ^[0-9a-f]+$ then, properties.FileSize log field is mapped to the target.process.file.size UDM field. Else, if the properties.MD5 log field value matches the regular expression pattern ^[0-9a-f]+$ then, properties.FileSize log field is mapped to the target.file.size UDM field.
properties.RemoteDeviceName	target.hostname
properties.RemoteIP	target.ip
properties.RemotePort	target.port
properties.ProcessCommandLine	target.process.command_line
properties.ProcessId	target.process.pid
properties.ProcessTokenElevation	target.process.token_elevation_type	If the properties.ProcessTokenElevation log field value is equal to TokenElevationTypeFull, then the target.process.token_elevation_type UDM field is set to TYPE_1. Else, if the properties.ProcessTokenElevation log field value is equal to TokenElevationTypeDefault, then the target.process.token_elevation_type UDM field is set to TYPE_2. Else, if the properties.ProcessTokenElevation log field value is equal to TokenElevationTypeLimited, then the target.process.token_elevation_type UDM field is set to TYPE_3.
properties.RegistryKey	target.registry.registry_key
properties.RegistryValueData	target.registry.registry_value_data
properties.RegistryValueName	target.registry.registry_value_name
properties.RemoteUrl	target.url
properties.AdditionalFields	additional.fields[additional_fields]
properties.AppGuardContainerId	additional.fields[app_guard_container_id]
properties.InitiatingProcessCreationTime	additional.fields[initiating_process_creation_time]
properties.InitiatingProcessLogonId	additional.fields[initiating_process_logon_id]
properties.InitiatingProcessParentCreationTime	additional.fields[initiating_process_parent_creation_time]
properties.ProcessCreationTime	additional.fields[process_creation_time]
properties.InitiatingProcessVersionInfoCompanyName	principal.process.file.exif_info.company
properties.InitiatingProcessVersionInfoFileDescription	principal.process.file.exif_info.file_description
properties.InitiatingProcessVersionInfoInternalFileName	additional.fields[process_version_info_internal_file_name]
properties.InitiatingProcessVersionInfoOriginalFileName	principal.process.file.exif_info.original_file
properties.InitiatingProcessVersionInfoProductName	principal.process.file.exif_info.product
properties.InitiatingProcessVersionInfoProductVersion	additional.fields[process_version_info_product_version]

Referência de mapeamento de campo: MICROSOFT DEFENDER ENDPOINT - AlertEvidence

A tabela a seguir lista os campos de registro do tipo AlertEvidence e os campos correspondentes do UDM:

Log field	UDM mapping	Logic
properties.Application	additional.fields[application]
	metadata.event_type	The metadata.event_type UDM field is set to SCAN_HOST.
properties.DeviceId	principal.asset_id	If the properties.DeviceId log field value is not empty, then the DeviceID:properties.DeviceId log field is mapped to the principal.asset_id UDM field.
properties.DeviceName	principal.hostname	If the properties.DeviceName log field value is not empty then, properties.DeviceName log field is mapped to the principal.hostname UDM field. Else, if the properties.AdditionalFields.HostName log field value is not empty then, properties.AdditionalFields.HostName log field is mapped to the principal.hostname UDM field. Else, if the properties.AdditionalFields.Host.HostName log field value is not empty then, properties.AdditionalFields.Host.HostName log field is mapped to the principal.hostname UDM field. Else, if the properties.AdditionalFields.ImageFile.Host.HostName log field value is not empty then, AdditionalFields.ImageFile.Host.HostName log field is mapped to the principal.hostname UDM field.
properties.LocalIP	principal.asset.ip	If the properties.LocalIP log field value is not empty, then the properties.LocalIP log field is mapped to the principal.asset.ip UDM field.
properties.FolderPath	target.file.full_path	If the properties.FileName log field value matches the regular expression pattern the properties.FolderPath, then the properties.FolderPath log field is mapped to the target.file.full_path UDM field. Else, the properties.FolderPath/properties.FileName log field is mapped to the target.file.full_path UDM field.
properties.FileName	target.file.names
properties.SHA1	target.file.sha1	If the properties.SHA1 log field value matches the regular expression pattern ^the 0-9a-f log field value+$, then the properties.SHA1 log field is mapped to the target.file.sha1 UDM field.
properties.SHA256	target.file.sha256	If the properties.SHA256 log field value matches the regular expression pattern ^the a-f0-9, then 64$, then the properties.SHA256 log field is mapped to the target.file.sha256 UDM field.
properties.FileSize	target.file.size
properties.AccountDomain	principal.administrative_domain
properties.RemoteIP	target.ip
properties.AdditionalFields	additional.fields[additionalfields]
properties.ProcessCommandLine	target.process.command_line
properties.RegistryKey	target.registry.registry_key
properties.RegistryValueData	target.registry.registry_value_data
properties.RegistryValueName	target.registry.registry_value_name
properties.CloudPlatform	principal.resource.attribute.cloud.environment	If the properties.CloudPlatform log field value matches the regular expression pattern /(?i)Amazon Web Services/, then the principal.resource.attribute.cloud.environment UDM field is set to AMAZON_WEB_SERVICES. Else, if the properties.CloudPlatform log field value matches the regular expression pattern /(?i)Google Cloud Platform/, then the principal.resource.attribute.cloud.environment UDM field is set to GOOGLE_CLOUD_PLATFORM. Else, if the properties.CloudPlatform log field value matches the regular expression pattern /(?i)Azure/, then the principal.resource.attribute.cloud.environment UDM field is set to MICROSOFT_AZURE. Else, the principal.resource.attribute.cloud.environment UDM field is set to UNSPECIFIED_CLOUD_ENVIRONMENT.
properties.SubscriptionId	principal.resource.attribute.labels[subscription_id]
properties.CloudResource	principal.resource.name
properties.ResourceID	principal.resource.product_object_id
	principal.resource.resource_type	The principal.resource.resource_type UDM field is set to CLOUD_PROJECT.
properties.Categories	security_result.category_details
properties.Severity	security_result.severity
properties.Title	security_result.summary
properties.Title	security_result.threat_name
properties.Title	security_result.rule_name
properties.ThreatFamily	security_result.detection_fields[threat_family]
properties.RemoteUrl	target.url
properties.EvidenceDirection	principal.user.attribute.labels[evidence_direction]
properties.EvidenceRole	principal.user.attribute.labels[evidence_role]
properties.AccountObjectId	additional.fields[account_object_id]
properties.AccountUpn	principal.user.user_display_name
properties.AccountName	principal.user.userid
properties.AccountSid	principal.user.windows_sid
properties.Timestamp	metadata.event_timestamp
properties.EntityType	principal.resource.resource_subtype
properties.AlertId	metadata.product_log_id
properties.DetectionSource	security_result.about.resource.attribute.labels[detection_source]
properties.ServiceSource	security_result.about.resource.attribute.labels[service_source]
properties.AttackTechniques	security_result.attack_details.techniques.name
properties.ApplicationId	additional.fields[application_id]
properties.EmailSubject	network.email.subject
properties.NetworkMessageId	network.email.mail_id
properties.OAuthApplicationId	additional.fields[oauth_application_id]

Referência de mapeamento de campo: MICROSOFT DEFENDER ENDPOINT - AlertInfo

A tabela a seguir lista os campos de registro do tipo AlertInfo e os campos correspondentes do UDM:

Log field	UDM mapping	Logic
	is_alert	The is_alert UDM field is set to true.
	is_significant	The is_significant UDM field is set to true.
properties.Timestamp	metadata.event_timestamp
	metadata.event_type	The metadata.event_type UDM field is set to GENERIC_EVENT.
properties.AlertId	metadata.product_log_id
properties.AttackTechniques	security_result.attack_details.techniques.name
properties.DetectionSource	security_result.detection_fields[detection_source]
properties.ServiceSource	security_result.detection_fields[service_source]
properties.Severity	security_result.severity	If the properties.Severity log field value matches the regular expression pattern (?i)(informational), then the security_result.severity UDM field is set to INFORMATIONAL. Else, if the properties.Severity log field value matches the regular expression pattern (?i)(low), then the security_result.severity UDM field is set to LOW. Else, if the properties.Severity log field value matches the regular expression pattern (?i)(medium), then the security_result.severity UDM field is set to MEDIUM. Else, if the properties.Severity log field value matches the regular expression pattern (?i)(high), then the security_result.severity UDM field is set to HIGH.
properties.Category	security_result.category_details
properties.Title	security_result.threat_name
properties.Title	security_result.rule_name

Referência de mapeamento de campo: MICROSOFT DEFENDER ENDPOINT - DeviceAlertEvents

A tabela a seguir lista os campos de registro do tipo DeviceAlertEvents e os campos correspondentes do UDM:

Log field	UDM mapping	Logic
	is_alert	The is_alert UDM field is set to true.
	is_significant	The is_significant UDM field is set to true.
properties.Timestamp	metadata.event_timestamp
	metadata.event_type	The metadata.event_type UDM field is set to SCAN_HOST.
properties.ReportId	security_result.detection_fields[report_id]
properties.DeviceId	principal.asset_id	The principal.asset_id is set to DeviceID:%{properties.DeviceId}.
properties.MachineGroup	principal.group.group_display_name
properties.DeviceName	principal.hostname
properties.AttackTechniques	security_result.attack_details.techniques.name
properties.Category	security_result.category_details
properties.AlertId	metadata.product_log_id
properties.MitreTechniques	security_result.detection_fields[mitre_techniques]
properties.Severity	security_result.severity	If the properties.Severity log field value is equal to High, then the security_result.severity UDM field is set to HIGH. Else, if the properties.Severity log field value is equal to Medium, then the security_result.severity UDM field is set to MEDIUM. Else, if the properties.Severity log field value is equal to Low, then the security_result.severity UDM field is set to LOW. Else, if the properties.Severity log field value is equal to Informational, then the security_result.severity UDM field is set to INFORMATIONAL.
properties.Title	security_result.threat_name
properties.Title	security_result.rule_name
properties.RemoteIp	target.ip
properties.FileName	target.file.names
properties.SHA1	target.file.sha1	If the properties.SHA1 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.SHA1 log field is mapped to the target.file.sha1 UDM field.
properties.RemoteUrl	target.url
properties.Table	additional.fields[table]

Referência de mapeamento de campo: MICROSOFT DEFENDER ENDPOINT - DeviceFileCertificateInfo

A tabela a seguir lista os campos de registro do tipo DeviceFileCertificateInfo e os campos correspondentes do UDM:

Log field	UDM mapping	Logic
properties.Timestamp	metadata.event_timestamp
	metadata.event_type	The metadata.event_type UDM field is set to STATUS_UPDATE.
properties.ReportId	metadata.product_log_id
properties.DeviceId	principal.asset_id	The principal.asset_id is set to DeviceID:%{properties.DeviceId}.
properties.SHA1	principal.file.sha1	If the properties.SHA1 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.SHA1 log field is mapped to the target.file.sha1 UDM field.
properties.Issuer	principal.file.signature_info.sigcheck.signers.cert_issuer
properties.Signer	principal.file.signature_info.sigcheck.signers.name
properties.IsSigned	principal.file.signature_info.sigcheck.verified	If the properties.IsSigned log field value is equal to true, then the principal.file.signature_info.sigcheck.verified UDM field is set to TRUE. Else, the principal.file.signature_info.sigcheck.verified UDM field is set to FALSE.
properties.DeviceName	principal.hostname
properties.CertificateCountersignatureTime	additional.fields[certificate_countersignature_time]
properties.CertificateSerialNumber	additional.fields[certificate_serial_number]
properties.CertificateCreationTime	additional.fields[certification_creation_time]
properties.CertificateExpirationTime	additional.fields[certification_expiration_time]
properties.CrlDistributionPointUrls	additional.fields[crl_distribution_point_urls]
properties.IsRootSignerMicrosoft	additional.fields[is_root_signer_microsoft]
properties.IsTrusted	additional.fields[is_trusted]
properties.IssuerHash	additional.fields[issuer_hash]
properties.SignatureType	additional.fields[signature_type]
properties.SignerHash	additional.fields[signer_hash]

Referência de mapeamento de campo: MICROSOFT DEFENDER ENDPOINT - DeviceImageLoadEvents

A tabela a seguir lista os campos de registro do tipo DeviceImageLoadEvents e os campos correspondentes do UDM:

Log field	UDM mapping	Logic
properties.Timestamp	metadata.event_timestamp
	metadata.event_type	The metadata.event_type UDM field is set to PROCESS_MODULE_LOAD.
properties.ReportId	metadata.product_log_id
properties.InitiatingProcessAccountDomain	principal.administrative_domain
principal.DeviceId	principal.asset_id	The principal.asset_id is set to DeviceID:%{principal.DeviceId}.
properties.DeviceName	principal.hostname
properties.InitiatingProcessCommandLine	principal.process.command_line
properties.InitiatingProcessFolderPath	principal.process.file.full_path	If the properties.InitiatingProcessFolderPath log field value matches the regular expression pattern the properties.InitiatingProcessFileName log field value, then the properties.InitiatingProcessFolderPath log field is mapped to the principal.process.file.full_path UDM field. Else, the principal.process.file.full_path is set to %{properties.InitiatingProcessFolderPath}/%{properties.InitiatingProcessFileName}.
properties.InitiatingProcessMD5	principal.process.file.md5	If the properties.InitiatingProcessMD5 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.InitiatingProcessMD5 log field is mapped to the principal.process.file.md5 UDM field.
properties.InitiatingProcessFileName	principal.process.file.names
properties.InitiatingProcessSHA1	principal.process.file.sha1	If the properties.InitiatingProcessSHA1 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.InitiatingProcessSHA1 log field is mapped to the principal.process.file.sha1 UDM field.
properties.InitiatingProcessSHA256	principal.process.file.sha256	If the properties.InitiatingProcessSHA256 log field value matches the regular expression pattern ^[a-f0-9]{64}$, then the properties.InitiatingProcessSHA256 log field is mapped to the principal.process.file.sha256 UDM field.
properties.InitiatingProcessFileSize	principal.process.file.size
properties.InitiatingProcessParentFileName	principal.process.parent_process.file.names
properties.InitiatingProcessParentId	principal.process.parent_process.pid
properties.InitiatingProcessId	principal.process.pid
properties.InitiatingProcessTokenElevation	principal.process.token_elevation_type	If the properties.InitiatingProcessTokenElevation log field value is equal to TokenElevationTypeFull, then the principal.process.token_elevation_type UDM field is set to TYPE_1. Else, if the properties.InitiatingProcessTokenElevation log field value is equal to TokenElevationTypeDefault, then the principal.process.token_elevation_type UDM field is set to TYPE_2. Else, if the properties.InitiatingProcessTokenElevation log field value is equal to TokenElevationTypeLimited, then the principal.process.token_elevation_type UDM field is set to TYPE_3.
properties.InitiatingProcessAccountObjectId	principal.user.product_object_id
properties.InitiatingProcessAccountUpn	principal.user.user_display_name
properties.InitiatingProcessAccountName	principal.user.userid
properties.InitiatingProcessAccountSid	principal.user.windows_sid
properties.FolderPath	target.process.file.full_path	If the properties.FolderPath log field value matches the regular expression pattern the properties.FileName, then the properties.FolderPath log field is mapped to the target.process.file.full_path UDM field. Else, the target.process.file.full_pathis set to %{properties.FolderPath}/%{properties.FileName}.
properties.MD5	target.process.file.md5	If the properties.MD5 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.MD5 log field is mapped to the target.process.file.md5 UDM field.
properties.FileName	target.process.file.names
properties.SHA1	target.process.file.sha1	If the properties.SHA1 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.SHA1 log field is mapped to the target.process.file.sha1 UDM field.
properties.SHA256	target.process.file.sha256	If the properties.SHA256 log field value matches the regular expression pattern ^[a-f0-9]{64}$, then the properties.SHA256 log field is mapped to the target.process.file.sha256 UDM field.
properties.FileSize	target.process.file.size
properties.FolderPath	target.file.full_path	If the properties.FolderPath log field value matches the regular expression pattern the properties.FileName, then the properties.FolderPath log field is mapped to the target.file.full_path UDM field. Else, the target.file.full_pathis set to %{properties.FolderPath}/%{properties.FileName}.
properties.MD5	target.file.md5	If the properties.MD5 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.MD5 log field is mapped to the target.process.file.md5 UDM field.
properties.FileName	target.file.names
properties.SHA1	target.file.sha1	If the properties.SHA1 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.SHA1 log field is mapped to the target.file.sha1 UDM field.
properties.SHA256	target.file.sha256	If the properties.SHA256 log field value matches the regular expression pattern ^[a-f0-9]{64}$, then the properties.SHA256 log field is mapped to the target.file.sha256 UDM field.
properties.FileSize	target.file.size
properties.AppGuardContainerId	additional.fields[app_guard_container_id]
properties.InitiatingProcessCreationTime	additional.fields[initiating_process_creation_time]
properties.InitiatingProcessIntegrityLevel	additional.fields[initiating_process_integrity_level]
properties.InitiatingProcessParentCreationTime	additional.fields[initiating_process_parent_creation_time]
properties.InitiatingProcessVersionInfoCompanyName	principal.process.file.exif_info.company
properties.InitiatingProcessVersionInfoFileDescription	principal.process.file.exif_info.file_description
properties.InitiatingProcessVersionInfoInternalFileName	additional.fields[initiating_process_version_info_internal_file_name]
properties.InitiatingProcessVersionInfoOriginalFileName	principal.process.file.exif_info.original_file
properties.InitiatingProcessVersionInfoProductName	principal.process.file.exif_info.product
properties.InitiatingProcessVersionInfoProductVersion	additional.fields[initiating_process_version_info_product_version]

Referência de mapeamento de campo: MICROSOFT DEFENDER ENDPOINT - DeviceFileEvents

A tabela a seguir lista os campos de registro do tipo DeviceFileEvents e os campos correspondentes do UDM:

Log field	UDM mapping	Logic
properties.Timestamp	metadata.event_timestamp
properties.ActionType	metadata.event_type	If the properties.ActionType log field value is equal to FileCreated, then the metadata.event_type UDM field is set to FILE_CREATION. Else, if the properties.ActionType log field value is equal to FileDeleted, then the metadata.event_type UDM field is set to FILE_DELETION. Else, if the properties.ActionType log field value is equal to FileModified, then the metadata.event_type UDM field is set to FILE_MODIFICATION. Else, if the properties.ActionType log field value is equal to FileRenamed, then the metadata.event_type UDM field is set to FILE_MOVE.
properties.ReportId	metadata.product_log_id
properties.RequestProtocol	network.application_protocol	If the properties.RequestProtocol log field value is equal to SMB, then the network.application_protocol UDM field is set to SMB. Else, if the properties.RequestProtocol log field value is equal to NFS, then the network.application_protocol UDM field is set to NFS. Else, if the properties.RequestProtocol log field value is equal to Local, then the network.application_protocol UDM field is set to UNKNOWN_APPLICATION_PROTOCOL.
properties.FileOriginReferrerUrl	network.http.referral_url
properties.InitiatingProcessAccountDomain	principal.administrative_domain	If the properties.InitiatingProcessAccountDomain log field value is not empty, then the properties.InitiatingProcessAccountDomain log field is mapped to the principal.administrative_domain UDM field.
properties.RequestAccountDomain	principal.administrative_domain	If the properties.InitiatingProcessAccountDomain log field value is empty, then the properties.RequestAccountDomain log field is mapped to the principal.administrative_domain UDM field.
properties.DeviceId	principal.asset_id	The principal.asset_id is set to DeviceID:%{properties.DeviceId}.
properties.DeviceName	principal.hostname
properties.FileOriginIP	principal.ip
properties.RequestSourceIP	principal.ip
properties.RequestSourcePort	principal.port
properties.InitiatingProcessCommandLine	principal.process.command_line
properties.InitiatingProcessFolderPath	principal.process.file.full_path	If the properties.InitiatingProcessFolderPath log field value matches the regular expression pattern the properties.InitiatingProcessFileName log field value, then the properties.InitiatingProcessFolderPath log field is mapped to the principal.process.file.full_path UDM field. Else, the principal.process.file.full_path is set to %{properties.InitiatingProcessFolderPath}/%{properties.InitiatingProcessFileName}.
properties.InitiatingProcessMD5	principal.process.file.md5	If the properties.InitiatingProcessMD5 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.InitiatingProcessMD5 log field is mapped to the principal.process.file.md5 UDM field.
properties.InitiatingProcessFileName	principal.process.file.names
properties.InitiatingProcessSHA1	principal.process.file.sha1	If the properties.InitiatingProcessSHA1 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.InitiatingProcessSHA1 log field is mapped to the principal.process.file.sha1 UDM field.
properties.InitiatingProcessSHA256	principal.process.file.sha256	If the properties.InitiatingProcessSHA256 log field value matches the regular expression pattern ^[a-f0-9]{64}$, then the properties.InitiatingProcessSHA256 log field is mapped to the principal.process.file.sha256 UDM field.
properties.InitiatingProcessFileSize	principal.process.file.size
properties.InitiatingProcessParentId	principal.process.parent_process.pid
properties.InitiatingProcessParentFileName	principal.process.parent_process.file.names
properties.InitiatingProcessId	principal.process.pid
properties.InitiatingProcessTokenElevation	principal.process.token_elevation_type	If the properties.InitiatingProcessTokenElevation log field value is equal to TokenElevationTypeFull, then the principal.process.token_elevation_type UDM field is set to TYPE_1. Else, if the properties.InitiatingProcessTokenElevation log field value is equal to TokenElevationTypeDefault, then the principal.process.token_elevation_type UDM field is set to TYPE_2. Else, if the properties.InitiatingProcessTokenElevation log field value is equal to TokenElevationTypeLimited, then the principal.process.token_elevation_type UDM field is set to TYPE_3.
properties.FileOriginUrl	principal.url
properties.InitiatingProcessAccountObjectId	principal.user.product_object_id
properties.InitiatingProcessAccountUpn	principal.user.user_display_name
properties.InitiatingProcessAccountName	principal.user.userid	If the properties.InitiatingProcessAccountName log field value is not empty, then the properties.InitiatingProcessAccountName log field is mapped to the principal.user.userid UDM field.
properties.RequestAccountName	principal.user.userid	If the properties.InitiatingProcessAccountName log field value is empty, then the properties.RequestAccountName log field is mapped to the principal.user.userid UDM field.
properties.InitiatingProcessAccountSid	principal.user.windows_sid	If the properties.InitiatingProcessAccountSid log field value is not empty, then the properties.InitiatingProcessAccountSid log field is mapped to the principal.user.windows_sid UDM field.
properties.RequestAccountSid	principal.user.windows_sid	If the properties.InitiatingProcessAccountSid log field value is empty, then the properties.RequestAccountSid log field is mapped to the principal.user.windows_sid UDM field.
properties.PreviousFolderPath	src.file.full_path	If the properties.PreviousFolderPath log field value matches the regular expression pattern the properties.PreviousFileName log field value, then the properties.PreviousFolderPath log field is mapped to the src.file.full_path UDM field. Else, src.file.full_path set to the %{properties.PreviousFolderPath}/%{properties.PreviousFileName}.
properties.PreviousFileName	src.file.names
properties.FolderPath	target.file.full_path	If the properties.FolderPath log field value matches the regular expression pattern the properties.FileName log field value, then the properties.FolderPath log field is mapped to the target.file.full_path UDM field. Else, the target.file.full_path set to %{properties.FolderPath}/%{properties.FileName}.
properties.MD5	target.file.md5	If the properties.MD5 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.MD5 log field is mapped to the target.file.md5 UDM field.
properties.FileName	target.file.names
properties.SHA1	target.file.sha1	If the properties.SHA1 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.SHA1 log field is mapped to the target.file.sha1 UDM field.
properties.SHA256	target.file.sha256	If the properties.SHA256 log field value matches the regular expression pattern ^[a-f0-9]{64}$, then the properties.SHA256 log field is mapped to the target.file.sha256 UDM field.
properties.FileSize	target.file.size
properties.SensitivityLabel	target.file.tags
properties.SensitivitySubLabel	target.file.tags
properties.AdditionalFields	additional.fields[additional_fields]
properties.AppGuardContainerId	additional.fields[app_guard_container_id]
properties.InitiatingProcessCreationTime	additional.fields[initiating_process_creation_time]
properties.InitiatingProcessIntegrityLevel	additional.fields[initiating_process_integrity_level]
properties.InitiatingProcessVersionInfoCompanyName	principal.process.file.exif_info.company
properties.InitiatingProcessVersionInfoFileDescription	principal.process.file.exif_info.file_description
properties.InitiatingProcessVersionInfoInternalFileName	additional.fields[initiating_process_version_info_internal_file_name]
properties.InitiatingProcessVersionInfoOriginalFileName	principal.process.file.exif_info.original_file
properties.InitiatingProcessVersionInfoProductName	principal.process.file.exif_info.product
properties.InitiatingProcessVersionInfoProductVersion	additional.fields[initiating_process_version_info_product_version]
properties.InitiatingProcessParentCreationTime	additional.fields[initiating_process_parent_creation_time]
properties.IsAzureInfoProtectionApplied	additional.fields[is_azure_info_protection_applied]
properties.ShareName	additional.fields[share_name]

Referência de mapeamento de campo: MICROSOFT DEFENDER ENDPOINT - DeviceInfo

A tabela a seguir lista os campos de registro do tipo DeviceInfo e os campos correspondentes do UDM:

Log field	UDM mapping	Logic
properties.DeviceId	entity.asset_id	The entity.asset_id is set to DeviceID:%{properties.DeviceId}.
properties.DeviceId	entity.asset.asset_id	The entity.asset.asset_id is set to DeviceID:%{properties.DeviceId}.
properties.AadDeviceId	entity.asset.attribute.labels[aad_device_id]
properties.AdditionalFields	entity.asset.attribute.labels[additional_fields]
properties.ConnectivityType	entity.asset.attribute.labels[connectivity_type]
properties.DeviceDynamicTags	entity.asset.attribute.labels[device_dynamic_tags]
properties.DeviceManualTags	entity.asset.attribute.labels[device_manual_tags]
properties.DeviceSubtype	entity.asset.attribute.labels[device_subtype]
properties.HostDeviceId	entity.asset.attribute.labels[host_device_id]
properties.IsAzureADJoined	entity.asset.attribute.labels[is_azure_ad_joined]
properties.IsInternetFacing	entity.asset.attribute.labels[is_internet_facing]
properties.JoinType	entity.asset.attribute.labels[join_type]
properties.MergedDeviceIds	entity.asset.attribute.labels[merged_device_ids]
properties.MergedToDeviceId	entity.asset.attribute.labels[merged_to_device_id]
properties.OnboardingStatus	entity.asset.attribute.labels[onboarding_status]
properties.OSArchitecture	entity.asset.attribute.labels[os_architecture]
properties.OSDistribution	entity.asset.attribute.labels[os_distribution]
properties.OSVersionInfo	entity.asset.attribute.labels[os_version_info]
properties.RegistryDeviceTag	entity.asset.attribute.labels[registry_divice_tag]
properties.ReportId	entity.asset.attribute.labels[report_id]
properties.SensorHealthState	entity.asset.attribute.labels[sensor_health_state]
properties.DeviceCategory	entity.asset.category
properties.Vendor	entity.asset.hardware.manufacturer
properties.Model	entity.asset.hardware.model
properties.DeviceName	entity.asset.hostname
properties.PublicIP	entity.asset.nat_ip
properties.OSBuild	entity.asset.platform_software.plateform_patch_level
properties.OSPlatform	entity.asset.platform_software.platform	If the properties.OSPlatform log field value matches the regular expression pattern (?i)macos, then the entity.asset.platform_software.platform UDM field is set to MAC. Else, if the properties.OSPlatform log field value matches the regular expression pattern (?i)windows, then the entity.asset.platform_software.platform UDM field is set to WINDOWS. Else, if the properties.OSPlatform log field value matches the regular expression pattern (?i)linux, then the entity.asset.platform_software.platform UDM field is set to LINUX.
properties.OSVersion	entity.asset.platform_software.platform_version
properties.ClientVersion	entity.asset.software.version
properties.DeviceType	entity.asset.type	If the properties.DeviceType log field value is equal to NetworkDevice, then the entity.asset.type UDM field is set to NETWORK_ATTACHED_STORAGE. Else, if the properties.DeviceType log field value is equal to Workstation, then the entity.asset.type UDM field is set to WORKSTATION. Else, if the properties.DeviceType log field value is equal to Server, then the entity.asset.type UDM field is set to SERVER. Else, if the properties.DeviceType log field value is equal to Mobile, then the entity.asset.type UDM field is set to MOBILE. Else if the properties.DeviceType log field value is equal to Printer, then the entity.asset.type UDM field is set to PRINTER.
properties.DeviceType	entity.asset.attribute.labels	if the properties.DeviceType log field value is equal to GamingConsole, then the properties.DeviceType log field is mapped to the entity.asset.attribute.labels UDM field.
properties.MachineGroup	entity.group.group_display_name
properties.ExclusionReason	entity.security_result.detection_fields[exclusion_reason]
properties.ExposureLevel	entity.security_result.detection_fields[exposure_level]
properties.IsExcluded	entity.security_result.detection_fields[is_excluded]
properties.AssetValue	entity.security_result.priority	If the properties.AssetValue log field value is equal to High, then the entity.security_result.priority UDM field is set to HIGH_PRIORITY. Else, if the properties.AssetValue log field value is equal to Medium, then the entity.security_result.priority UDM field is set to MEDIUM_PRIORITY. Else, if the properties.AssetValue log field value is equal to Low, then the entity.security_result.priority UDM field is set to LOW_PRIORITY. Else, the properties.AssetValue log field is mapped to the entity.security_result.detection_fields.asset_value UDM field.
properties.Timestamp	metadata.creation_timestamp
	metadata.entity_type	The metadata.entity_type UDM field is set to ASSET.
properties.DeviceId	metadata.product_entity_id	The metadata.product_entity_id is set to DeviceID:%{properties.DeviceId}.
	relations.direction	The relations.direction UDM field is set to UNIDIRECTIONAL.
	relations.entity_type	The relations.entity_type UDM field is set to USER.
	relations.relationship	The relations.relationship UDM field is set to MEMBER.
properties.LoggedOnUsers.DomainName	relations.entity.domain.name
properties.LoggedOnUsers.UserName	relations.entity.user.userid
properties.LoggedOnUsers.Sid	relations.entity.user.windows_sid
properties.LoggedOnUsers

Referência de mapeamento de campo: MICROSOFT DEFENDER ENDPOINT - DeviceIdentityLogonEvents

A tabela a seguir lista os campos de registro do tipo DeviceIdentityLogonEvents e os campos correspondentes do UDM:

Log field	UDM mapping	Logic
properties.Application	additional.fields[application]
	metadata.event_type	The metadata.event_type UDM field is set to SCAN_HOST.
properties.DeviceId	principal.asset_id	If the properties.DeviceId log field value is not empty, then the AssetID:properties.DeviceId log field is mapped to the principal.asset_id UDM field. else, then the AssetID:properties.AdditionalFields.MachineId log field is mapped to the principal.asset_id UDM field.
properties.DeviceName	principal.hostname	If the properties.DeviceName log field value is not empty, then the properties.DeviceName log field is mapped to the principal.hostname UDM field.
properties.LocalIP	principal.asset.ip	If the properties.LocalIP log field value is not empty, then the properties.LocalIP log field is mapped to the principal.asset.ip UDM field.
properties.FolderPath	target.file.full_path	If the properties.FileName log field value matches the regular expression pattern the properties.FolderPath, then the properties.FolderPath log field is mapped to the target.file.full_path UDM field. Else, the properties.FolderPath/properties.FileName log field is mapped to the target.file.full_path UDM field.
properties.FileName	target.file.names
properties.SHA1	target.file.sha1	If the properties.SHA1 log field value matches the regular expression pattern ^the 0-9a-f log field value+$, then the properties.SHA1 log field is mapped to the target.file.sha1 UDM field.
properties.SHA256	target.file.sha256	If the properties.SHA256 log field value matches the regular expression pattern ^the a-f0-9, then 64$, then the properties.SHA256 log field is mapped to the target.file.sha256 UDM field.
properties.FileSize	target.file.size
properties.AccountDomain	principal.administrative_domain
properties.RemoteIP	target.ip
properties.AdditionalFields	additional.fields[additionalfields]
properties.ProcessCommandLine	target.process.command_line
properties.RegistryKey	target.registry.registry_key
properties.RegistryValueData	target.registry.registry_value_data
properties.RegistryValueName	target.registry.registry_value_name
properties.CloudPlatform	principal.resource.attribute.cloud.environment	If the properties.CloudPlatform log field value matches the regular expression pattern /(?i)Amazon Web Services/, then the principal.resource.attribute.cloud.environment UDM field is set to AMAZON_WEB_SERVICES. Else, if the properties.CloudPlatform log field value matches the regular expression pattern /(?i)Google Cloud Platform/, then the principal.resource.attribute.cloud.environment UDM field is set to GOOGLE_CLOUD_PLATFORM. Else, if the properties.CloudPlatform log field value matches the regular expression pattern /(?i)Azure/, then the principal.resource.attribute.cloud.environment UDM field is set to MICROSOFT_AZURE. Else, the principal.resource.attribute.cloud.environment UDM field is set to UNSPECIFIED_CLOUD_ENVIRONMENT.
properties.SubscriptionId	principal.resource.attribute.labels[subscription_id]
properties.CloudResource	principal.resource.name
properties.ResourceID	principal.resource.product_object_id
	principal.resource.resource_type	The principal.resource.resource_type UDM field is set to CLOUD_PROJECT.
properties.Categories	security_result.category_details
properties.Severity	security_result.severity
properties.Title	security_result.summary
properties.ThreatFamily	security_result.threat_name
properties.RemoteUrl	target.url
properties.EvidenceDirection	principal.user.attribute.labels[evidence_direction]
properties.EvidenceRole	principal.user.attribute.labels[evidence_role]
properties.AccountObjectId	additional.fields[account_object_id]
properties.AccountUpn	principal.user.user_display_name
properties.AccountName	principal.user.userid
properties.AccountSid	principal.user.windows_sid
properties.Timestamp	metadata.event_timestamp
properties.EntityType	principal.resource.resource_subtype
properties.AlertId	metadata.product_log_id
properties.DetectionSource	security_result.about.resource.attribute.labels[detection_source]
properties.ServiceSource	security_result.about.resource.attribute.labels[service_source]
properties.AttackTechniques	security_result.attack_details.techniques.name
properties.ApplicationId	additional.fields[application_id]
properties.EmailSubject	network.email.subject
properties.NetworkMessageId	network.email.mail_id
properties.OAuthApplicationId	additional.fields[oauth_application_id]

Referência de mapeamento de campo: MICROSOFT DEFENDER ENDPOINT - DeviceLogonEvents

A tabela a seguir lista os campos de registro do tipo DeviceLogonEvents e os campos correspondentes do UDM:

Log field	UDM mapping	Logic
properties.LogonType	extensions.auth.mechanism	If the properties.LogonType log field value is equal to Interactive, then the extensions.auth.mechanism UDM field is set to INTERACTIVE. Else, if the properties.LogonType log field value is equal to Network, then the extensions.auth.mechanism UDM field is set to NETWORK. Else, if the properties.LogonType log field value is equal to Batch, then the extensions.auth.mechanism UDM field is set to BATCH. Else, if the properties.LogonType log field value is equal to Service, then the extensions.auth.mechanism UDM field is set to SERVICE. Else, if the properties.LogonType log field value is equal to RemoteInteractive, then the extensions.auth.mechanism UDM field is set to REMOTE_INTERACTIVE.
properties.Timestamp	metadata.event_timestamp
	metadata.event_type	The metadata.event_type UDM field is set to USER_LOGIN.
properties.ReportId	metadata.product_log_id
properties.Protocol	network.ip_protocol	If the properties.Protocol log field value is equal to Tcp, then the network.ip_protocol UDM field is set to TCP. If the properties.Protocol log field value is equal to Udp, then the network.ip_protocol UDM field is set to UDP. If the properties.Protocol log field value is equal to Icmp, then the network.ip_protocol UDM field is set to ICMP.
properties.LogonId	network.session_id
properties.InitiatingProcessAccountDomain	principal.administrative_domain
properties.DeviceId	principal.asset_id	The principal.asset_id is set to DeviceID:%{properties.DeviceId}.
properties.DeviceName	principal.hostname
properties.InitiatingProcessCommandLine	principal.process.command_line
properties.InitiatingProcessFolderPath	principal.process.file.full_path	If the properties.InitiatingProcessFolderPath log field value matches the regular expression pattern the properties.InitiatingProcessFileName log field value, then the properties.InitiatingProcessFolderPath log field is mapped to the principal.process.file.full_path UDM field. Else, the principal.process.file.full_path is set to %{properties.InitiatingProcessFolderPath}/%{properties.InitiatingProcessFileName}.
properties.InitiatingProcessMD5	principal.process.file.md5	If the properties.InitiatingProcessMD5 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.InitiatingProcessMD5 log field is mapped to the principal.process.file.md5 UDM field.
properties.InitiatingProcessFileName	principal.process.file.names
properties.InitiatingProcessSHA1	principal.process.file.sha1	If the properties.InitiatingProcessSHA1 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.InitiatingProcessSHA1 log field is mapped to the principal.process.file.sha1 UDM field.
properties.InitiatingProcessSHA256	principal.process.file.sha256	If the properties.InitiatingProcessSHA256 log field value matches the regular expression pattern ^[a-f0-9]{64}$, then the properties.InitiatingProcessSHA256 log field is mapped to the principal.process.file.sha256 UDM field.
properties.InitiatingProcessFileSize	principal.process.file.size
properties.InitiatingProcessParentFileName	principal.process.parent_process.file.names
properties.InitiatingProcessParentId	principal.process.parent_process.pid
properties.InitiatingProcessId	principal.process.pid
properties.InitiatingProcessTokenElevation	principal.process.token_elevation_type	If the properties.InitiatingProcessTokenElevation log field value is equal to TokenElevationTypeFull, then the principal.process.token_elevation_type UDM field is set to TYPE_1. Else, if the properties.InitiatingProcessTokenElevation log field value is equal to TokenElevationTypeDefault, then the principal.process.token_elevation_type UDM field is set to TYPE_2. Else, if the properties.InitiatingProcessTokenElevation log field value is equal to TokenElevationTypeLimited, then the principal.process.token_elevation_type UDM field is set to TYPE_3.
properties.InitiatingProcessAccountObjectId	principal.user.product_object_id
properties.InitiatingProcessAccountUpn	principal.user.user_display_name
properties.InitiatingProcessAccountName	principal.user.userid
properties.InitiatingProcessAccountSid	principal.user.windows_sid
properties.FailureReason	security_result.description
properties.AccountDomain	target.administrative_domain
properties.RemoteDeviceName	target.hostname
properties.RemoteIP	target.ip
properties.RemotePort	target.port
properties.IsLocalAdmin	target.resource.attribute.labels[is_local_admin]
properties.AccountName	target.user.userid
properties.AccountSid	target.user.windows_sid
properties.RemoteIPType	additional.fields[remote_ip_type]
properties.AdditionalFields	additional.fields[additional_fields]
properties.AppGuardContainerId	additional.fields[app_guard_container_id]
properties.InitiatingProcessCreationTime	additional.fields[initiating_process_creation_time]
properties.InitiatingProcessIntegrityLevel	additional.fields[initiating_process_integrity_level]
properties.InitiatingProcessVersionInfoCompanyName	principal.process.file.exif_info.company
properties.InitiatingProcessVersionInfoFileDescription	principal.process.file.exif_info.file_description
properties.InitiatingProcessVersionInfoInternalFileName	additional.fields[initiating_process_version_info_internal_file_name]
properties.InitiatingProcessVersionInfoOriginalFileName	principal.process.file.exif_info.original_file
properties.InitiatingProcessVersionInfoProductName	principal.process.file.exif_info.product
properties.InitiatingProcessVersionInfoProductVersion	additional.fields[initiating_process_version_info_product_version]
properties.InitiatingProcessParentCreationTime	additional.fields[initiating_process_parent_creation_time]

Referência de mapeamento de campo: MICROSOFT DEFENDER ENDPOINT - DeviceNetworkEvents

A tabela a seguir lista os campos de registro do tipo DeviceNetworkEvents e os campos correspondentes do UDM:

Log field	UDM mapping	Logic
properties.Timestamp	metadata.event_timestamp
	metadata.event_type	The metadata.event_type UDM field is set to NETWORK_CONNECTION.
properties.ReportId	metadata.product_log_id
properties.Protocol	network.ip_protocol	If the properties.Protocol log field value is equal to Tcp, then the network.ip_protocol UDM field is set to TCP. Else, if the properties.Protocol log field value is equal to Udp, then the network.ip_protocol UDM field is set to UDP. Else, if the properties.Protocol log field value is equal to Icmp, then the network.ip_protocol UDM field is set to ICMP.
properties.InitiatingProcessAccountDomain	principal.administrative_domain
properties.DeviceId	principal.asset_id	The principal.asset_id is set to DeviceID:%{properties.DeviceId}.
properties.DeviceName	principal.hostname
properties.LocalIP	principal.ip
properties.LocalPort	principal.port
properties.InitiatingProcessCommandLine	principal.process.command_line
properties.InitiatingProcessFolderPath	principal.process.file.full_path	If the properties.InitiatingProcessFolderPath log field value matches the regular expression pattern the properties.InitiatingProcessFileName log field value, then the properties.InitiatingProcessFolderPath log field is mapped to the principal.process.file.full_path UDM field. Else, the principal.process.file.full_path is set to %{properties.InitiatingProcessFolderPath}/%{properties.InitiatingProcessFileName}.
properties.InitiatingProcessMD5	principal.process.file.md5	If the properties.InitiatingProcessMD5 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.InitiatingProcessMD5 log field is mapped to the principal.process.file.md5 UDM field.
properties.InitiatingProcessFileName	principal.process.file.names
properties.InitiatingProcessSHA1	principal.process.file.sha1	If the properties.InitiatingProcessSHA1 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.InitiatingProcessSHA1 log field is mapped to the principal.process.file.sha1 UDM field.
properties.InitiatingProcessSHA256	principal.process.file.sha256	If the properties.InitiatingProcessSHA256 log field value matches the regular expression pattern ^[a-f0-9]{64}$, then the properties.InitiatingProcessSHA256 log field is mapped to the principal.process.file.sha256 UDM field.
properties.InitiatingProcessFileSize	principal.process.file.size
properties.InitiatingProcessParentFileName	principal.process.parent_process.file.names
properties.InitiatingProcessParentId	principal.process.parent_process.pid
properties.InitiatingProcessId	principal.process.pid
properties.InitiatingProcessTokenElevation	principal.process.token_elevation_type	If the properties.InitiatingProcessTokenElevation log field value is equal to TokenElevationTypeFull, then the principal.process.token_elevation_type UDM field is set to TYPE_1. Else, if the properties.InitiatingProcessTokenElevation log field value is equal to TokenElevationTypeDefault, then the principal.process.token_elevation_type UDM field is set to TYPE_2. Else, if the properties.InitiatingProcessTokenElevation log field value is equal to TokenElevationTypeLimited, then the principal.process.token_elevation_type UDM field is set to TYPE_3.
properties.InitiatingProcessAccountObjectId	principal.user.product_object_id
properties.InitiatingProcessAccountUpn	principal.user.user_display_name
properties.InitiatingProcessAccountName	principal.user.userid
properties.InitiatingProcessAccountSid	principal.user.windows_sid
properties.RemoteIP	target.ip
properties.RemotePort	target.port
properties.RemoteUrl	target.url
properties.LocalIPType	additional_fields[LocalIPType]
properties.RemoteIPType	additional_fields[RemoteIPType]
properties.AdditionalFields	additional.fields[additional_fields]
properties.AppGuardContainerId	additional.fields[app_guard_container_id]
properties.InitiatingProcessCreationTime	additional.fields[initiating_process_creation_time]
properties.InitiatingProcessIntegrityLevel	additional.fields[initiating_process_integrity_level]
properties.InitiatingProcessParentCreationTime	additional.fields[initiating_process_parent_creation_time]
properties.InitiatingProcessVersionInfoCompanyName	principal.process.file.exif_info.company
properties.InitiatingProcessVersionInfoFileDescription	principal.process.file.exif_info.file_description
properties.InitiatingProcessVersionInfoInternalFileName	additional.fields[initiating_process_version_info_internal_file_name]
properties.InitiatingProcessVersionInfoOriginalFileName	principal.process.file.exif_info.original_file
properties.InitiatingProcessVersionInfoProductName	principal.process.file.exif_info.product
properties.InitiatingProcessVersionInfoProductVersion	additional.fields[initiating_process_version_info_product_version]

Referência de mapeamento de campo: MICROSOFT DEFENDER ENDPOINT - DeviceNetworkInfo

A tabela a seguir lista os campos de registro do tipo DeviceNetworkInfo e os campos correspondentes do UDM:

Log field	UDM mapping	Logic
DeviceNetworkInfo
properties.DeviceId	entity.asset_id	The entity.asset_id is set to DeviceID:%{properties.DeviceId}.
properties.DeviceId	entity.asset.asset_id	The entity.asset.asset_id is set to DeviceID:%{properties.DeviceId}.
properties.ReportId	entity.asset.attribute.labels[report_id]
properties.ConnectedNetworks	entity.asset.attribute.labels[connected_networks]
properties.MacAddress	entity.asset.mac
properties.NetworkAdapterName	entity.asset.attribute.labels[network_adapter_name]
properties.NetworkAdapterStatus	entity.asset.attribute.labels[network_adapter_status]
properties.NetworkAdapterType	entity.asset.attribute.labels[network_adapter_type]
properties.NetworkAdapterVendor	entity.asset.attribute.labels[network_adapter_vendor]
properties.TunnelType	entity.asset.attribute.labels[tunnel_type]
properties.DefaultGateways	entity.asset.attribute.labels[default_gateways]
properties.DeviceName	entity.asset.hostname
properties.IPAddresses	entity.asset.ip
	entity.asset.type	The entity.asset.type UDM field is set to WORKSTATION.
properties.DnsAddresses	entity.domain.last_dns_records.type	The entity.domain.last_dns_records.type UDM field is set to ip_address.
properties.DnsAddresses	entity.domain.last_dns_records.value	The properties.DnsAddresses log field is mapped to the entity.domain.last_dns_records.value UDM field.
properties.IPv4Dhcp	entity.network.dhcp.ciaddr	If the properties.IPv4Dhcp log field value is not empty, then the properties.IPv4Dhcp log field is mapped to the entity.network.dhcp.ciaddr UDM field. Else, the properties.IPv6Dhcp log field is mapped to the entity.network.dhcp.ciaddr UDM field.
properties.Timestamp	metadata.creation_time
	metadata.entity_type	The metadata.entity_type UDM field is set to ASSET.
properties.DeviceId	metadata.product_entity_id	The metadata.product_entity_id is set to DeviceID:%{properties.DeviceId}.

Referência de mapeamento de campo: MICROSOFT DEFENDER ENDPOINT - DeviceProcessEvents

A tabela a seguir lista os campos de registro do tipo DeviceProcessEvents e os campos correspondentes do UDM:

Log field	UDM mapping	Logic
properties.Timestamp	metadata.event_timestamp
properties.ActionType	metadata.event_type	If the properties.ActionType log field value matches the regular expression pattern (?i)ProcessCreated, then the metadata.event_type UDM field is set to PROCESS_LAUNCH. Else, if the properties.ActionType log field value matches the regular expression pattern (?i)OpenProcess, then the metadata.event_type UDM field is set to PROCESS_OPEN.
properties.ReportId	metadata.product_log_id
properties.LogonId	network.session_id
properties.InitiatingProcessAccountDomain	principal.administrative_domain
properties.DeviceId	principal.asset_id	The principal.asset_id is set to DeviceID:%{properties.DeviceId}.
properties.DeviceName	principal.hostname
properties.InitiatingProcessCommandLine	principal.process.command_line
properties.InitiatingProcessFolderPath	principal.process.file.full_path	If the properties.InitiatingProcessFolderPath log field value matches the regular expression pattern the properties.InitiatingProcessFileName log field value, then the properties.InitiatingProcessFolderPath log field is mapped to the principal.process.file.full_path UDM field. Else, the principal.process.file.full_path is set to %{properties.InitiatingProcessFolderPath}/%{properties.InitiatingProcessFileName}.
properties.InitiatingProcessMD5	principal.process.file.md5	If the properties.InitiatingProcessMD5 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.InitiatingProcessMD5 log field is mapped to the principal.process.file.md5 UDM field.
properties.InitiatingProcessFileName	principal.process.file.names
properties.InitiatingProcessSHA1	principal.process.file.sha1	If the properties.InitiatingProcessSHA1 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.InitiatingProcessSHA1 log field is mapped to the principal.process.file.sha1 UDM field.
properties.InitiatingProcessSHA256	principal.process.file.sha256	If the properties.InitiatingProcessSHA256 log field value matches the regular expression pattern ^[a-f0-9]{64}$, then the properties.InitiatingProcessSHA256 log field is mapped to the principal.process.file.sha256 UDM field.
properties.InitiatingProcessSignatureStatus	principal.process.file.signature_info.sigcheck.signers.status
properties.InitiatingProcessFileSize	principal.process.file.size
properties.InitiatingProcessParentId	principal.process.parent_process.pid
properties.InitiatingProcessParentFileName	principal.process.parent_process.file.names
properties.InitiatingProcessId	principal.process.pid
properties.InitiatingProcessTokenElevation	principal.process.token_elevation_type	If the properties.InitiatingProcessTokenElevation log field value is equal to TokenElevationTypeFull, then the principal.process.token_elevation_type UDM field is set to TYPE_1. Else, if the properties.InitiatingProcessTokenElevation log field value is equal to TokenElevationTypeDefault, then the principal.process.token_elevation_type UDM field is set to TYPE_2. Else, if the properties.InitiatingProcessTokenElevation log field value is equal to TokenElevationTypeLimited, then the principal.process.token_elevation_type UDM field is set to TYPE_3
properties.InitiatingProcessAccountObjectId	principal.user.product_object_id
properties.InitiatingProcessAccountUpn	principal.user.user_display_name
properties.InitiatingProcessAccountName	principal.user.userid
properties.InitiatingProcessAccountSid	principal.user.windows_sid
properties.AccountDomain	target.administrative_domain
properties.FolderPath	target.file.full_path	If the properties.FolderPath log field value matches the regular expression pattern the properties.FileName log field value, then the properties.FolderPath log field is mapped to the target.file.full_path UDM field. Else, the target.file.full_path set to %{properties.FolderPath}/%{properties.FileName}.
properties.MD5	target.process.file.md5	If the properties.MD5 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.MD5 log field is mapped to the target.file.md5 UDM field.
properties.FileName	target.process.file.names
properties.SHA1	target.process.file.sha1	If the properties.SHA1 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.SHA1 log field is mapped to the target.file.sha1 UDM field.
properties.SHA256	target.process.file.sha256	If the properties.SHA256 log field value matches the regular expression pattern ^[a-f0-9]{64}$, then the properties.SHA256 log field is mapped to the target.file.sha256 UDM field.
properties.FileSize	target.process.file.size
properties.ProcessCommandLine	target.process.command_line
properties.ProcessId	target.process.pid
properties.ProcessTokenElevation	target.process.token_elevation_type	If the properties.ProcessTokenElevation log field value is equal to TokenElevationTypeFull, then the target.process.token_elevation_type UDM field is set to TYPE_1. Else, if the properties.ProcessTokenElevation log field value is equal to TokenElevationTypeDefault, then the target.process.token_elevation_type UDM field is set to TYPE_2. Else, if the properties.ProcessTokenElevation log field value is equal to TokenElevationTypeLimited, then the target.process.token_elevation_type UDM field is set to TYPE_3.
properties.ProcessIntegrityLevel	target.resource.attribute.labels[process_integrity_level]
properties.AccountUpn	target.user.user_display_name
properties.AccountName	target.user.userid
properties.AccountSid	target.user.windows_sid
properties.InitiatingProcessCreationTime	additional.fields[initiating_process_creation_time]
properties.InitiatingProcessParentCreationTime	additional.fields[initiating_process_parent_creation_time]
properties.AccountObjectId	additional.fields[account_object_id]
properties.AdditionalFields	additional.fields[additional_fields]
properties.AppGuardContainerId	additional.fields[app_guard_container_id]
properties.InitiatingProcessIntegrityLevel	additional.fields[initiating_process_integrity_level]
properties.InitiatingProcessLogonId	additional.fields[initiating_process_logon_id]
properties.InitiatingProcessSignerType	additional.fields[initiating_process_signer_type]
properties.InitiatingProcessVersionInfoCompanyName	principal.process.file.exif_info.company
properties.InitiatingProcessVersionInfoFileDescription	principal.process.file.exif_info.file_description
properties.InitiatingProcessVersionInfoInternalFileName	additional.fields[initiating_process_version_info_internal_file_name]
properties.InitiatingProcessVersionInfoOriginalFileName	principal.process.file.exif_info.original_file
properties.InitiatingProcessVersionInfoProductName	principal.process.file.exif_info.product
properties.InitiatingProcessVersionInfoProductVersion	additional.fields[initiating_process_version_info_product_version]
properties.ProcessCreationTime	additional.fields[process_creation_time]
properties.ProcessVersionInfoCompanyName	target.process.file.exif_info.company
properties.ProcessVersionInfoFileDescription	target.process.file.exif_info.file_description
properties.ProcessVersionInfoInternalFileName	additional.fields[process_version_info_internal_file_name]
properties.ProcessVersionInfoOriginalFileName	target.process.file.exif_info.original_file
properties.ProcessVersionInfoProductName	target.process.file.exif_info.product
properties.ProcessVersionInfoProductVersion	additional.fields[process_version_info_product_version]

Referência de mapeamento de campo: MICROSOFT DEFENDER ENDPOINT - DeviceTvmInfoGathering

A tabela a seguir lista os campos de registro do tipo DeviceTvmInfoGathering e os campos correspondentes do UDM:

Log field	UDM mapping	Logic
properties.Timestamp	metadata.event_timestamp
	metadata.event_type	The metadata.event_type UDM field is set to SCAN_HOST.
properties.DeviceId	principal.asset_id	The principal.asset_id is set to DeviceID:%{properties.DeviceId}.
properties.OSPlatform	principal.asset.platform_software.platform	If the properties.OSPlatform log field value matches the regular expression pattern (?i)macos, then the principal.asset.platform_software.platform UDM field is set to MAC. Else, if the properties.OSPlatform log field value matches the regular expression pattern (?i)windows, then the principal.asset.platform_software.platform UDM field is set to WINDOWS. Else, if the properties.OSPlatform log field value matches the regular expression pattern (?i)linux, then the principal.asset.platform_software.platform UDM field is set to LINUX.
properties.OSPlatform	principal.asset.platform_software.platform_version
properties.DeviceName	principal.hostname
properties.LastSeenTime	security.result.last_discovered_time
properties.AdditionalFields	additional.fields[additional_fields]

Referência de mapeamento de campo: MICROSOFT DEFENDER ENDPOINT - DeviceRegistryEvents

A tabela a seguir lista os campos de registro do tipo DeviceRegistryEvents e os campos correspondentes do UDM:

Log field	UDM mapping	Logic
properties.Timestamp	metadata.event_timestamp
properties.ActionType	metadata.event_type	If the properties.ActionType log field value matches the regular expression pattern (?i)RegistryKeyCreated, then the metadata.event_type UDM field is set to REGISTRY_CREATION. Else, if the properties.ActionType log field value matches the regular expression pattern (?i)RegistryKeyDeleted, then the metadata.event_type UDM field is set to REGISTRY_DELETION. Else, if the properties.ActionType log field value matches the regular expression pattern (?i)RegistryKeyRenamed, then the metadata.event_type UDM field is set to REGISTRY_MODIFICATION. Else, if the properties.ActionType log field value matches the regular expression pattern (?i)RegistryValueDeleted, then the metadata.event_type UDM field is set to REGISTRY_DELETION. Else, if the properties.ActionType log field value matches the regular expression pattern (?i)RegistryValueSet, then the metadata.event_type UDM field is set to REGISTRY_MODIFICATION. Else, the metadata.event_type UDM field is set to REGISTRY_UNCATEGORIZED.
properties.ReportId	metadata.product_log_id
properties.InitiatingProcessAccountDomain	principal.administrative_domain
properties.DeviceId	principal.asset_id	The principal.asset_id is set to DeviceID:%{properties.DeviceId}.
properties.DeviceName	principal.hostname
properties.InitiatingProcessCommandLine	principal.process.command_line
properties.InitiatingProcessFolderPath	principal.process.file.full_path	If the properties.InitiatingProcessFolderPath log field value matches the regular expression pattern the properties.InitiatingProcessFileName log field value, then the properties.InitiatingProcessFolderPath log field is mapped to the principal.process.file.full_path UDM field. Else, the principal.process.file.full_path is set to %{properties.InitiatingProcessFolderPath}/%{properties.InitiatingProcessFileName}.
properties.InitiatingProcessMD5	principal.process.file.md5	If the properties.InitiatingProcessMD5 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.InitiatingProcessMD5 log field is mapped to the principal.process.file.md5 UDM field.
properties.InitiatingProcessFileName	principal.process.file.names
properties.InitiatingProcessSHA1	principal.process.file.sha1	If the properties.InitiatingProcessSHA1 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.InitiatingProcessSHA1 log field is mapped to the principal.process.file.sha1 UDM field.
properties.InitiatingProcessSHA256	principal.process.file.sha256	If the properties.InitiatingProcessSHA256 log field value matches the regular expression pattern ^[a-f0-9]{64}$, then the properties.InitiatingProcessSHA256 log field is mapped to the principal.process.file.sha256 UDM field.
properties.InitiatingProcessFileSize	principal.process.file.size
properties.InitiatingProcessParentFileName	principal.process.parent_process.file.names
properties.InitiatingProcessParentId	principal.process.parent_process.pid
properties.InitiatingProcessId	principal.process.pid
properties.PreviousRegistryValueData	principal.registry.registry_value_data
properties.PreviousRegistryKey	principal.registry.registry_key
properties.PreviousRegistryValueName	principal.registry.registry_value_name
properties.InitiatingProcessAccountObjectId	principal.user.attribute.labels[initiating_process_account_object_id]
properties.InitiatingProcessAccountUpn	principal.user.attribute.labels[initiating_process_account_upn]
properties.InitiatingProcessAccountName	principal.user.userid
properties.InitiatingProcessAccountSid	principal.user.windows_sid
properties.InitiatingProcessTokenElevation	principal.process.token_elevation_type	If the properties.InitiatingProcessTokenElevation log field value is equal to TokenElevationTypeFull, then the principal.process.token_elevation_type UDM field is set to TYPE_1. Else, if the properties.InitiatingProcessTokenElevation log field value is equal to TokenElevationTypeDefault, then the principal.process.token_elevation_type UDM field is set to TYPE_2. Else, if the properties.InitiatingProcessTokenElevation log field value is equal to TokenElevationTypeLimited, then the principal.process.token_elevation_type UDM field is set to TYPE_3.
properties.RegistryValueData	target.registry.registry_value_data
properties.RegistryKey	target.registry.registry_key
properties.RegistryValueName	target.registry.registry_value_name
properties.InitiatingProcessCreationTime	additional.fields[initiating_process_creation_time]
properties.InitiatingProcessIntegrityLevel	additional.fields[initiating_process_integrity_level]
properties.InitiatingProcessParentCreationTime	additional.fields[initiating_process_parent_creation_time]
properties.AppGuardContainerId	additional.fields[app_guard_container_id]
properties.InitiatingProcessVersionInfoCompanyName	principal.process.file.exif_info.company
properties.InitiatingProcessVersionInfoFileDescription	principal.process.file.exif_info.file_description
properties.InitiatingProcessVersionInfoInternalFileName	additional.fields[initiating_process_version_info_internal_file_name]
properties.InitiatingProcessVersionInfoOriginalFileName	principal.process.file.exif_info.original_file
properties.InitiatingProcessVersionInfoProductName	principal.process.file.exif_info.product
properties.InitiatingProcessVersionInfoProductVersion	additional.fields[initiating_process_version_info_product_version]
properties.RegistryValueType	additional.fields[registry_value_type]

Referência de mapeamento de campo: MICROSOFT DEFENDER ENDPOINT - DeviceTvmInfoGatheringKB

A tabela a seguir lista os campos de registro do tipo DeviceTvmInfoGatheringKB e os campos correspondentes do UDM:

Log field	UDM mapping	Logic
properties.Description	metadata.description
	metadata.event_type	The metadata.event_type UDM field is set to GENERIC_EVENT.
properties.IgId	metadata.product_log_id
properties.Categories	principal.resource.attribute.labels[categories]
properties.DataStructure	principal.resource.attribute.labels[data_structure]
properties.FieldName	principal.resource.name

Referência de mapeamento de campo: MICROSOFT DEFENDER ENDPOINT - DeviceTvmSecureConfigurationAssessment

A tabela a seguir lista os campos de registro do tipo DeviceTvmSecureConfigurationAssessment e os campos correspondentes do UDM:

Log field	UDM mapping	Logic
properties.Timestamp	metadata.event_timestamp
	metadata.event_type	The metadata.event_type UDM field is set to SCAN_UNCATEGORIZED.
properties.DeviceId	principal.asset_id	The principal.asset_id is set to DeviceID:%{properties.DeviceId}.
properties.OSPlatform	principal.asset.platform_software.platform	If the properties.OSPlatform log field value matches the regular expression pattern (?i)macos, then the prinipal.asset.platform_software.platform UDM field is set to MAC. Else, if the properties.OSPlatform log field value matches the regular expression pattern (?i)windows, then the principal.asset.platform_software.platform UDM field is set to WINDOWS. Else, if the properties.OSPlatform log field value matches the regular expression pattern (?i)linux, then the principal.asset.platform_software.platform UDM field is set to LINUX.
properties.DeviceName	principal.hostname
properties.ConfigurationCategory	principal.resource.attribute.labels[configuration_category]
properties.ConfigurationImpact	principal.resource.attribute.labels[configuration_impact]
properties.Context	principal.resource.attribute.labels[contex]
properties.IsApplicable	principal.resource.attribute.labels[is_applicable]
properties.IsCompliant	principal.resource.attribute.labels[is_compliant]
properties.IsExpectedUserImpact	principal.resource.attribute.labels[is_expected_user_impact]
properties.ConfigurationId	principal.resource.product_object_id
properties.ConfigurationSubcategory	principal.resource.resource_subtype
	principal.resource.resource_type	The principal.resource.resource_type UDM field is set to ACCESS_POLICY.

Referência de mapeamento de campo: MICROSOFT DEFENDER ENDPOINT - DeviceTvmSecureConfigurationAssessmentKB

A tabela a seguir lista os campos de registro do tipo DeviceTvmSecureConfigurationAssessmentKB e os campos correspondentes do UDM:

Log field	UDM mapping	Logic
	metadata.event_type	The metadata.event_type UDM field is set to GENERIC_EVENT.
properties.ConfigurationBenchmarks	principal.resource.attribute.labels[configuration_benchmarks]
properties.ConfigurationCategory	principal.resource.attribute.labels[configuration_category]
properties.ConfigurationDescription	principal.resource.attribute.labels[configuration_description]
properties.ConfigurationImpact	principal.resource.attribute.labels[configuration_impact]
properties.RemediationOptions	principal.resource.attribute.labels[remediation_options]
properties.RiskDescription	principal.resource.attribute.labels[risk_description]
properties.Tags	principal.resource.attribute.labels[tags]
properties.ConfigurationName	principal.resource.name
properties.ConfigurationId	principal.resource.product_object_id
properties.ConfigurationSubcategory	principal.resource.resource_subtype
	principal.resource.resource_type	The principal.resource.resource_type UDM field is set to ACCESS_POLICY.

Referência de mapeamento de campo: MICROSOFT DEFENDER ENDPOINT - DeviceTvmSoftwareEvidenceBeta

A tabela a seguir lista os campos de registro do tipo DeviceTvmSoftwareEvidenceBeta e os campos correspondentes do UDM:

Log field	UDM mapping	Logic
	metadata.event_type	The metadata.event_type UDM field is set to GENERIC_EVENT.
properties.DeviceId	principal.asset_id	The principal.asset_id is set to DeviceID:%{properties.DeviceId}.
properties.DiskPaths	principal.asset.attribute.labels[disk_paths]	The properties.DiskPaths log field is mapped to the principal.asset.attribute.labels.disk_paths UDM field.
properties.RegistryPaths	principal.asset.attribute.labels[registry_paths]	The properties.RegistryPaths log field is mapped to the principal.asset.attribute.labels.registry_paths UDM field.
properties.LastSeenTime	principal.asset.last_discover_time
properties.SoftwareName	principal.asset.software.name
properties.SoftwareVendor	principal.asset.software.vendor_name
properties.SoftwareVersion	principal.asset.software.version

Referência de mapeamento de campo: MICROSOFT DEFENDER ENDPOINT - DeviceTvmSoftwareInventory

A tabela a seguir lista os campos de registro do tipo DeviceTvmSoftwareInventory e os campos correspondentes do UDM:

Log field	UDM mapping	Logic
	metadata.event_type	The metadata.event_type UDM field is set to GENERIC_EVENT.
properties.DeviceId	principal.asset_id	The principal.asset_id is set to DeviceID:%{properties.DeviceId}.
properties.EndOfSupportDate	principal.asset.attribute.labels[end_of_support_date]
properties.EndOfSupportStatus	principal.asset.attribute.labels[end_of_support_status]
properties.OSArchitecture	principal.asset.attribute.labels[os_architecture]
properties.ProductCodeCpe	principal.asset.attribute.labels[product_code_cpe]
properties.OSPlatform	principal.asset.platform_software.platform	If the properties.OSPlatform log field value matches the regular expression pattern (?i)macos, then the prinipal.asset.platform_software.platform UDM field is set to MAC. Else, if the properties.OSPlatform log field value matches the regular expression pattern (?i)windows, then the principal.asset.platform_software.platform UDM field is set to WINDOWS. Else, if the properties.OSPlatform log field value matches the regular expression pattern (?i)linux, then the principal.asset.platform_software.platform UDM field is set to LINUX.
properties.OSVersion	principal.asset.platform_software.platform_version
properties.SoftwareName	principal.asset.software.name
properties.SoftwareVendor	principal.asset.software.vendor_name
properties.SoftwareVersion	principal.asset.software.version
properties.DeviceName	principal.hostname

Referência de mapeamento de campo: MICROSOFT DEFENDER ENDPOINT - DeviceTvmSoftwareVulnerabilities

A tabela a seguir lista os campos de registro do tipo DeviceTvmSoftwareVulnerabilities e os campos correspondentes do UDM:

Log field	UDM mapping	Logic
properties.CveId	extensions.vulns.vulnerabilities.cve_id
properties.VulnerabilityLevel	extensions.vulns.vulnerabilities.severity	If the properties.VulnerabilityLevel log field value is equal to High, then the extensions.vulns.vulnerabilities.severity UDM field is set to HIGH. Else, if the properties.VulnerabilityLevel log field value is equal to Medium, then the extensions.vulns.vulnerabilities.severity UDM field is set to MEDIUM. Else, if the properties.VulnerabilityLevel log field value is equal to Low, then the extensions.vulns.vulnerabilities.severity UDM field is set to LOW. Else, if the properties.VulnerabilityLevel log field value is equal to Informational, then the extensions.vulns.vulnerabilities.severity UDM field is set to INFORMATIONAL.
properties.SeverityLevel	extensions.vulns.vulnerablitities.severity_details
	metadata.event_type	The metadata.event_type UDM field is set to SCAN_VULN_HOST.
properties.DeviceId	principal.asset_id	The principal.asset_id is set to DeviceID:%{properties.DeviceId}.
properties.OSPlatform	principal.asset.platform_software.platform	If the properties.OSPlatform log field value matches the regular expression pattern (?i)macos, then the principal.asset.platform_software.platform UDM field is set to MAC. Else, if the properties.OSPlatform log field value matches the regular expression pattern (?i)windows, then the principal.asset.platform_software.platform UDM field is set to WINDOWS. Else, if the properties.OSPlatform log field value matches the regular expression pattern (?i)linux, then the principal.asset.platform_software.platform UDM field is set to LINUX.
properties.OSVersion	principal.asset.platform_software.platform_version
properties.SoftwareName	principal.asset.software.name
properties.SoftwareVendor	principal.asset.software.vendor_name
properties.SoftwareVersion	principal.asset.software.version
properties.DeviceName	principal.hostname
properties.RecommendedSecurityUpdateId	security_result.detection_fields[recommended_security_update_id]
properties.RecommendedSecurityUpdate	security_result.detection_fields[recommended_security_update]
properties.CveTags	additional.fields[cve_tags]

Referência de mapeamento de campo: MICROSOFT DEFENDER ENDPOINT - DeviceTvmSoftwareVulnerabilitiesKB

A tabela a seguir lista os campos de registro do tipo DeviceTvmSoftwareVulnerabilitiesKB e os campos correspondentes do UDM:

Log field	UDM mapping	Logic
	metadata.event_type	The metadata.event_type UDM field is set to GENERIC_EVENT.
properties.CveId	extensions.vulns.vulnerabilities.cve_id
properties.CvssScore	extensions.vulns.vulnerablities.cvss_base_score
properties.IsExploitAvailable	extensions.vulns.vulnerablities.cvss_vector
properties.VulnerabilitySeverityLevel	extensions.vulns.vulnerabilities.severity	If the properties.VulnerabilitySeverityLevel log field value is equal to High, then the extensions.vulns.vulnerabilities.severity UDM field is set to HIGH. Else, if the properties.VulnerabilitySeverityLevel log field value is equal to Medium, then the extensions.vulns.vulnerabilities.severity UDM field is set to MEDIUM. Else, if the properties.VulnerabilitySeverityLevel log field value is equal to Low, then the extensions.vulns.vulnerabilities.severity UDM field is set to LOW. Else, if the properties.VulnerabilitySeverityLevel log field value is equal to Informational, then the extensions.vulns.vulnerabilities.severity UDM field is set to INFORMATIONAL. Else, the extensions.vulns.vulnerabilities.severity UDM field is set to UNKNOWN_SEVERITY.
properties.VulnerabilitySeverityLevel	extensions.vulns.vulnerablitities.severity_details
properties.LastModifiedTime	extensions.vulns.vulnerabilities.scan_end_time
properties.PublishedDate	extensions.vulns.vulnerabilities.first_found
properties.VulnerabilityDescription	extensions.vulns.vulnerabilities.cve_description
properties.AffectedSoftware	extensions.vulns.vulnerabilities.description

Referência de mapeamento de campo: MICROSOFT DEFENDER ENDPOINT - EmailAttachmentInfo

A tabela a seguir lista os campos de registro do tipo EmailAttachmentInfo e os campos correspondentes do UDM:

Log field	UDM mapping	Logic
properties.FileType	target.file.mime_type
properties.FileName	target.file.names
properties.SHA256	target.file.sha256	If the properties.SHA256 log field value matches the regular expression pattern ^[a-f0-9]{64}$, then the properties.SHA256 log field is mapped to the target.file.sha256 UDM field.
properties.FileSize	target.file.size
properties.Timestamp	metadata.event_timestamp
	metadata.event_type	The metadata.event_type UDM field is set to EMAIL_TRANSACTION.
properties.ReportId	metadata.product_log_id
properties.SenderFromAddress	network.email.from	If the properties.SenderFromAddress log field value matches the regular expression pattern ^.+@.+$, then the properties.SenderFromAddress log field is mapped to the network.email.from UDM field.
properties.NetworkMessageId	network.email.mail_id
properties.RecipientEmailAddress	network.email.to	If the properties.RecipientEmailAddress log field value matches the regular expression pattern ^.+@.+$, then the properties.RecipientEmailAddress log field is mapped to the network.email.to UDM field.
properties.SenderFromAddress	principal.user.email_addresses	If the properties.SenderFromAddress log field value matches the regular expression pattern ^.+@.+$, then the properties.SenderFromAddress log field is mapped to the principal.user.email_addresses UDM field.
properties.SenderObjectId	principal.user.product_object_id
properties.SenderDisplayName	principal.user.user_display_name
properties.ThreatTypes	security_result.category	If the properties.ThreatTypes log field value is equal to Phish, then the security_result.category UDM field is set to MAIL_PHISHING.
properties.DetectionMethods	security_result.detection_fields[detection_methods]
properties.ThreatNames	security_result.threat_name
properties.RecipientEmailAddress	target.user.email_addresses	If the properties.RecipientEmailAddress log field value matches the regular expression pattern ^.+@.+$, then the properties.RecipientEmailAddress log field is mapped to the target.user.email_addresses UDM field.
properties.RecipientObjectId	target.user.product_object_id

Referência de mapeamento de campo: MICROSOFT DEFENDER ENDPOINT - EmailEvents

A tabela a seguir lista os campos de registro do tipo EmailEvents e os campos correspondentes do UDM:

Log field	UDM mapping	Logic
properties.Timestamp	metadata.event_timestamp
	metadata.event_type	The metadata.event_type UDM field is set to EMAIL_TRANSACTION.
properties.ReportId	metadata.product_log_id
properties.EmailDirection	network.direction	If the properties.EmailDirection log field value is equal to Inbound, then the network.direction UDM field is set to INBOUND. Else, if the properties.EmailDirection log field value is equal to Outbound, then the network.direction UDM field is set to OUTBOUND. Else, the network.direction UDM field is set to UNKNOWN_DIRECTION.
properties.NetworkMessageId	network.email.mail_id
properties.Subject	network.email.subject
properties.RecipientEmailAddress	network.email.to
properties.SenderFromDomain	principal.administrative_domain
properties.SenderIPv4	principal.ip
properties.SenderIPv6	principal.ip
properties.SenderMailFromAddress	principal.user.attribute.labels[sender_mail_from_address]
properties.SenderFromAddress	principal.user.email_addresses	If the properties.SenderFromAddress log field value matches the regular expression pattern ^.+@.+$, then the properties.SenderFromAddress log field is mapped to the principal.user.email_addresses UDM field.
properties.SenderMailFromDomain	principal.user.attribute.labels[sender_mail_from_domain]
properties.SenderObjectId	principal.user.product_object_id
properties.SenderDisplayName	principal.user.user_display_name
properties.ThreatTypes	security_result.category	If the properties.ThreatTypes log field value is equal to Phish, then the security_result.category UDM field is set to MAIL_PHISHING.
properties.ThreatTypes	security_result.category_details
properties.ConfidenceLevel	security_result.confidence_details
properties.EmailAction	security_result.description
properties.AuthenticationDetails	security_result.detection_fields[authentication_details]
properties.BulkComplaintLevel	security_result.detection_fields[bulk_complaint_level]
properties.DetectionMethods	security_result.detection_fields[detection_methods]
properties.EmailActionPolicyGuid	security_result.rule_id
properties.EmailActionPolicy	security_result.rule_name
properties.ThreatNames	security_result.threat_name
properties.OrgLevelAction	security_result.rule_labels[org_level_action]
properties.OrgLevelPolicy	security_result.rule_labels[org_level_policy]
properties.UserLevelAction	security_result.rule_labels[user_level_action]
properties.UserLevelPolicy	security_result.rule_labels[user_level_policy]
properties.RecipientEmailAddress	target.user.email_addresses	If the properties.RecipientEmailAddress log field value matches the regular expression pattern ^.+@.+$, then the properties.RecipientEmailAddress log field is mapped to the target.user.email_addresses UDM field.
properties.RecipientObjectId	target.user.product_object_id
properties.AdditionalFields	additional.fields[additional_fields]
properties.DeliveryAction	additional.fields[delivery_action]
properties.DeliveryLocation	additional.fields[delivery_location]	The properties.DeliveryLocation log field is mapped to the additional.fields.delivery_location UDM field.
properties.EmailClusterId	additional.fields[email_cluster_id]
properties.EmailLanguage	additional.fields[email_language]
properties.InternetMessageId	additional.fields[internet_message_id]
properties.LatestDeliveryLocation	additional.fields[last_delivery_location]
properties.UrlCount	additional.fields[connectors]
properties.Connectors	additional.fields[attachment_count]
properties.AttachmentCount	additional.fields[latest_delivery_action]
properties.LatestDeliveryAction	additional.fields[latest_delivery_action]

Referência de mapeamento de campo: MICROSOFT DEFENDER ENDPOINT - EmailPostDeliveryEvents

A tabela a seguir lista os campos de registro do tipo EmailPostDeliveryEvents e os campos correspondentes do UDM:

Log field	UDM mapping	Logic
properties.Timestamp	metadata.event_timestamp
	metadata.event_type	The metadata.event_type UDM field is set to EMAIL_UNCATEGORIZED.
properties.ReportId	security_result.detection_fields[report_id]
properties.NetworkMessageId	network.email.mail_id
properties.ActionResult	security_result.summary
properties.ThreatTypes	security_result.category	If the properties.ThreatTypes log field value is equal to Phish, then the security_result.category UDM field is set to MAIL_PHISHING.
properties.ThreatTypes	security_result.category_details
properties.ActionTrigger	security_result.detection_fields[action_trigger]
properties.DeliveryLocation	security_result.detection_fields[delivery_location]
properties.DetectionMethods	security_result.detection_fields[detection_methods]
properties.Action	security_result.action_details
properties.ActionType	security_result.verdict_info.verdict_type	If the properties.ActionType log field value is equal to Manual Remediation, then the security_result.verdict_info.verdict_type UDM field is set to ANALYST_VERDICT. Else, if the properties.ActionType log field contains one of the following values, then the security_result.verdict_info.verdict_type UDM field is set to PROVIDER_ML_VERDICT. Phish ZAP Malware ZAP Spam ZAP .
properties.RecipientEmailAddress	target.user.email_addresses	If the properties.RecipientEmailAddress log field value matches the regular expression pattern ^.+@.+$, then the properties.RecipientEmailAddress log field is mapped to the target.user.email_addresses UDM field.
properties.InternetMessageId	additional.fields[internet_message_id]

Referência de mapeamento de campo: MICROSOFT DEFENDER ENDPOINT - EmailUrlInfo

A tabela a seguir lista os campos de registro do tipo EmailUrlInfo e os campos correspondentes do UDM:

Log field	UDM mapping	Logic
properties.UrlDomain	target.hostname
properties.Url	target.url
properties.Timestamp	metadata.event_timestamp
	metadata.event_type	The metadata.event_type UDM field is set to EMAIL_TRANSACTION.
properties.ReportId	metadata.product_log_id
properties.NetworkMessageId	network.email.mail_id
properties.UrlLocation	additional.fields[url_location]

Referência de mapeamento de campo: MICROSOFT DEFENDER ENDPOINT - IdentityInfo

A tabela a seguir lista os campos de registro do tipo IdentityInfo e os campos correspondentes do UDM:

Log field	UDM mapping	Logic
properties.SourceSystem	entity.resource.parent
properties.AccountDomain	entity.administrative_domain
properties.TenantId	entity.resource.product_object_id
properties.CreatedDateTime	entity.user.attribute.creation_time
properties.AccountUpn	entity.user.attribute.labels[account_upn]
properties.ChangeSource	entity.user.attribute.labels[change_source]
properties.CloudSid	entity.user.attribute.labels[cloud_sid]
properties.ReportId	entity.user.attribute.labels[report_id]
properties.SipProxyAddress	entity.user.attribute.labels[sip_proxy_address]
properties.SourceProvider	entity.user.attribute.labels[source_provider]
properties.Tags	entity.user.attribute.labels[tags]
properties.Type	entity.user.attribute.role.name
properties.DistinguishedName	entity.user.attributes.labels[distinguished_name]
properties.Department	entity.user.department
properties.EmailAddress	entity.user.email_addresses	If the properties.EmailAddress log field value matches the regular expression pattern ^.+@.+$, then the properties.EmailAddress log field is mapped to the entity.user.email_addresses UDM field.
properties.GivenName	entity.user.first_name
properties.Surname	entity.user.last_name
properties.Manager	entity.user.managers.user_display_name
properties.City	entity.user.personal_address.city
properties.Country	entity.user.personal_address.country_or_region
properties.Address	entity.user.personal_address.name
properties.Phone	entity.user.phone_numbers
properties.AccountObjectId	entity.user.product_object_id
properties.AssignedRoles	entity.user.role_description
properties.JobTitle	entity.user.title
properties.IsAccountEnabled	entity.user.user_authentication_status	If the properties.IsAccountEnabled log field value is equal to 1, then the entity.user.user_authentication_status UDM field is set to ACTIVE. Else, the entity.user.user_authentication_status UDM field is set to SUSPENDED.
properties.AccountDisplayName	entity.user.user_display_name
properties.AccountName	entity.user.userid
properties.OnPremSid	entity.user.attribute.labels[on_prem_sid]
properties.Timestamp	metadata.creation_time
	metadata.entity_type	The metadata.entity_type UDM field is set to USER.
properties.AccountObjectId	metadata.product_entity_id

A seguir

• Ingestão de dados no Google SecOps