Microsoft fields
Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Serverless
Generally available
Stack
Generally available
Microsoft Module
Module for ingesting Microsoft Defender ATP.
microsoft.defender_atp.lastUpdateTime-
The date and time (in UTC) the alert was last updated.
type: date
microsoft.defender_atp.resolvedTime-
The date and time in which the status of the alert was changed to 'Resolved'.
type: date
microsoft.defender_atp.incidentId-
The Incident ID of the Alert.
type: keyword
microsoft.defender_atp.investigationId-
The Investigation ID related to the Alert.
type: keyword
microsoft.defender_atp.investigationState-
The current state of the Investigation.
type: keyword
microsoft.defender_atp.assignedTo-
Owner of the alert.
type: keyword
microsoft.defender_atp.status-
Specifies the current status of the alert. Possible values are: 'Unknown', 'New', 'InProgress' and 'Resolved'.
type: keyword
microsoft.defender_atp.classification-
Specification of the alert. Possible values are: 'Unknown', 'FalsePositive', 'TruePositive'.
type: keyword
microsoft.defender_atp.determination-
Specifies the determination of the alert. Possible values are: 'NotAvailable', 'Apt', 'Malware', 'SecurityPersonnel', 'SecurityTesting', 'UnwantedSoftware', 'Other'.
type: keyword
microsoft.defender_atp.threatFamilyName-
Threat family.
type: keyword
microsoft.defender_atp.rbacGroupName-
User group related to the alert
type: keyword
microsoft.defender_atp.evidence.domainName-
Domain name related to the alert
type: keyword
microsoft.defender_atp.evidence.ipAddress-
IP address involved in the alert
type: ip
microsoft.defender_atp.evidence.aadUserId-
ID of the user involved in the alert
type: keyword
microsoft.defender_atp.evidence.accountName-
Username of the user involved in the alert
type: keyword
microsoft.defender_atp.evidence.entityType-
The type of evidence
type: keyword
microsoft.defender_atp.evidence.userPrincipalName-
Principal name of the user involved in the alert
type: keyword
The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability This functionality is in beta and is not ready for production usage. For beta features, the design and code is less mature than official GA features and is being provided as-is with no warranties. Beta features are not subject to the support SLA of official GA features. Specific Support terms apply. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Stack
Beta
Beta
Module for ingesting Microsoft Defender ATP.
microsoft.m365_defender.incidentId-
Unique identifier to represent the incident.
type: keyword
microsoft.m365_defender.redirectIncidentId-
Only populated in case an incident is being grouped together with another incident, as part of the incident processing logic.
type: keyword
microsoft.m365_defender.incidentName-
Name of the Incident.
type: keyword
microsoft.m365_defender.determination-
Specifies the determination of the incident. The property values are: NotAvailable, Apt, Malware, SecurityPersonnel, SecurityTesting, UnwantedSoftware, Other.
type: keyword
microsoft.m365_defender.investigationState-
The current state of the Investigation.
type: keyword
microsoft.m365_defender.assignedTo-
Owner of the alert.
type: keyword
microsoft.m365_defender.tags-
Array of custom tags associated with an incident, for example to flag a group of incidents with a common characteristic.
type: keyword
microsoft.m365_defender.status-
Specifies the current status of the alert. Possible values are: 'Unknown', 'New', 'InProgress' and 'Resolved'.
type: keyword
microsoft.m365_defender.classification-
Specification of the alert. Possible values are: 'Unknown', 'FalsePositive', 'TruePositive'.
type: keyword
microsoft.m365_defender.alerts.incidentId-
Unique identifier to represent the incident this alert is associated with.
type: keyword
microsoft.m365_defender.alerts.resolvedTime-
Time when alert was resolved.
type: date
microsoft.m365_defender.alerts.status-
Categorize alerts (as New, Active, or Resolved).
type: keyword
microsoft.m365_defender.alerts.severity-
The severity of the related alert.
type: keyword
microsoft.m365_defender.alerts.creationTime-
Time when alert was first created.
type: date
microsoft.m365_defender.alerts.lastUpdatedTime-
Time when alert was last updated.
type: date
microsoft.m365_defender.alerts.investigationId-
The automated investigation id triggered by this alert.
type: keyword
microsoft.m365_defender.alerts.userSid-
The SID of the related user
type: keyword
microsoft.m365_defender.alerts.detectionSource-
The service that initially detected the threat.
type: keyword
microsoft.m365_defender.alerts.classification-
The specification for the incident. The property values are: Unknown, FalsePositive, TruePositive or null.
type: keyword
microsoft.m365_defender.alerts.investigationState-
Information on the investigation's current status.
type: keyword
microsoft.m365_defender.alerts.determination-
Specifies the determination of the incident. The property values are: NotAvailable, Apt, Malware, SecurityPersonnel, SecurityTesting, UnwantedSoftware, Other or null
type: keyword
microsoft.m365_defender.alerts.assignedTo-
Owner of the incident, or null if no owner is assigned.
type: keyword
microsoft.m365_defender.alerts.actorName-
The activity group, if any, the associated with this alert.
type: keyword
microsoft.m365_defender.alerts.threatFamilyName-
Threat family associated with this alert.
type: keyword
microsoft.m365_defender.alerts.mitreTechniques-
The attack techniques, as aligned with the MITRE ATT&CK™ framework.
type: keyword
microsoft.m365_defender.alerts.entities.entityType-
Entities that have been identified to be part of, or related to, a given alert. The properties values are: User, Ip, Url, File, Process, MailBox, MailMessage, MailCluster, Registry.
type: keyword
microsoft.m365_defender.alerts.entities.accountName-
Account name of the related user.
type: keyword
microsoft.m365_defender.alerts.entities.mailboxDisplayName-
The display name of the related mailbox.
type: keyword
microsoft.m365_defender.alerts.entities.mailboxAddress-
The mail address of the related mailbox.
type: keyword
microsoft.m365_defender.alerts.entities.clusterBy-
A list of metadata if the entityType is MailCluster.
type: keyword
microsoft.m365_defender.alerts.entities.sender-
The sender for the related email message.
type: keyword
microsoft.m365_defender.alerts.entities.recipient-
The recipient for the related email message.
type: keyword
microsoft.m365_defender.alerts.entities.subject-
The subject for the related email message.
type: keyword
microsoft.m365_defender.alerts.entities.deliveryAction-
The delivery status for the related email message.
type: keyword
microsoft.m365_defender.alerts.entities.securityGroupId-
The Security Group ID for the user related to the email message.
type: keyword
microsoft.m365_defender.alerts.entities.securityGroupName-
The Security Group Name for the user related to the email message.
type: keyword
microsoft.m365_defender.alerts.entities.registryHive-
Reference to which Hive in registry the event is related to, if eventType is registry. Example: HKEY_LOCAL_MACHINE.
type: keyword
microsoft.m365_defender.alerts.entities.registryKey-
Reference to the related registry key to the event.
type: keyword
microsoft.m365_defender.alerts.entities.registryValueType-
Value type of the registry key/value pair related to the event.
type: keyword
microsoft.m365_defender.alerts.entities.deviceId-
The unique ID of the device related to the event.
type: keyword
microsoft.m365_defender.alerts.entities.ipAddress-
The related IP address to the event.
type: keyword
microsoft.m365_defender.alerts.devices-
The devices related to the investigation.
type: flattened