收集 Microsoft Defender for Endpoint 日志

支持的平台：

本文档介绍了如何通过设置 Google Security Operations Feed 来收集 Microsoft Defender for Endpoint 日志，以及日志字段如何映射到 Google SecOps 统一数据模型 (UDM) 字段。

如需了解详情，请参阅将数据注入 Google SecOps。

典型部署包括 Microsoft Defender for Endpoint 和配置为将日志发送到 Google SecOps 的 Google SecOps Feed。您的部署可能与本文档中描述的典型部署不同。部署包含以下组件：

  • Microsoft Defender for Endpoint：用于收集日志的平台。

  • Azure 存储：用于存储日志的平台。

  • Google SecOps Feed：从 Microsoft Defender for Endpoint 中提取日志并将日志写入 Google SecOps 的 Google SecOps Feed。

  • Google SecOps：用于保留和分析 Microsoft Defender for Endpoint 日志的平台。

注入标签用于标识将原始日志数据标准化为结构化 UDM 格式的解析器。本文档中的信息适用于具有 MICROSOFT_DEFENDER_ENDPOINT 注入标签的解析器。

准备工作

确保您满足以下前提条件：

配置 Azure 存储账号

本部分介绍如何在 Microsoft Azure 中配置和部署 Azure 存储账号。

创建存储账号

开始之前，请确保您的资源组已成功部署到 Azure 环境中。

  1. 在 Azure 门户中，搜索存储账号。
  2. 点击创建。

  3. 在基本标签页下，提供以下配置详细信息：

    设置 值
    订阅 选择您的 Azure 订阅。
    资源组 选择已部署的资源组。
    存储账号名称 输入一个介于 3 到 24 个字符之间的全局唯一名称，且只能使用小写字母和数字。
    区域 选择距离您的用户或工作负载最近的区域。
    主要服务 选择主要服务，例如 Azure Blob Storage 或 Azure Data Lake Storage Gen2。
    性能 选择标准（推荐用于大多数情况）或优质（用于低延迟工作负载）。
    冗余 根据可用性要求选择复制选项（例如本地冗余存储 (LRS)）。

  4. 点击 Review + create（检查 + 创建）。

  5. 验证通过后，点击创建以部署存储账号。

设置 Microsoft Defender for Endpoint

  1. 以全局管理员或安全管理员身份登录 security.microsoft.com。
  2. 在左侧窗格中，点击设置。
  3. 选择 Microsoft Defender XDR 标签页。
  4. 从“常规”部分中选择 Streaming API，然后点击添加。
  5. 选择将事件转发到 Azure Storage。
  6. 前往您选择的存储账号。
  7. 依次选择概览 > JSON 视图，然后输入资源 ID。
  8. 输入资源 ID 后，选择所有必需的数据类型。
  9. 点击保存。

设置 Feed

您可以通过两种不同的入口点在 Google SecOps 平台中设置 Feed：

  • SIEM 设置 > Feed > 添加新 Feed
  • 内容中心 > 内容包 > 开始

如何设置 Microsoft Defender for Endpoint Feed

  1. 点击 Microsoft Defender 包。
  2. 找到 Microsoft Defender for Endpoint 日志类型。

  3. 在以下字段中指定值：

    • 来源类型：Microsoft Azure Blob Storage V2。
    • Azure URI：指向 Azure Blob Storage Blob 或容器的 URI。
    • 源删除选项：是否在转移后删除文件或目录。
    • 文件存在时间上限：包含在过去指定天数内修改过的文件。默认值为 180 天。
    • 选择共享密钥或 SAS 令牌。
    • 密钥：用于访问 Azure 资源的共享密钥或 SAS 令牌。

    高级选项

    • Feed 名称：用于标识 Feed 的预填充值。
    • 资源命名空间：与 Feed 关联的命名空间。
    • 提取标签：应用于相应 Feed 中所有事件的标签。

  4. 点击创建 Feed。

如需详细了解如何为相应产品系列中的不同日志类型配置多个 Feed，请参阅按产品配置 Feed。

支持的 Microsoft Defender for Endpoint 日志类型

Microsoft Defender for Endpoint 解析器支持以下表格：

  • AlertEvidence
  • AlertInfo
  • CloudAppEvents
  • DeviceAlertEvents
  • DeviceEvents
  • DeviceFileCertificateInfo
  • DeviceFileEvents
  • DeviceImageLoadEvents
  • DeviceInfo
  • DeviceLogonEvents
  • DeviceNetworkEvents
  • DeviceNetworkInfo
  • DeviceProcessEvents
  • DeviceRegistryEvents
  • DeviceTvmInfoGathering
  • DeviceTvmInfoGatheringKB
  • DeviceTvmSecureConfigurationAssessment
  • DeviceTvmSecureConfigurationAssessmentKB
  • DeviceTvmSoftwareEvidenceBeta
  • DeviceTvmSoftwareInventory
  • DeviceTvmSoftwareVulnerabilities
  • DeviceTvmSoftwareVulnerabilitiesKB
  • EmailAttachmentInfo
  • EmailEvents
  • EmailPostDeliveryEvents
  • EmailUrlInfo
  • IdentityInfo
  • IdentityLogonEvents

支持的 Microsoft Defender for Endpoint 日志格式

Microsoft Defender for Endpoint 解析器支持 JSON 格式的日志。

支持的 Microsoft Defender for Endpoint 示例日志

  • JSON：

    {
  "time": "2021-07-16T09:57:38.1599837Z",
  "tenantId": "ed236696-8612-40d7-8b49-xxxxxxxxxxx",
  "operationName": "Publish",
  "category": "AdvancedHunting-DeviceInfo",
  "properties": {
    "OSBuild": null,
    "RegistryDeviceTag": null,
    "IsAzureADJoined": null,
    "PublicIP": "198.51.100.0",
    "OSArchitecture": null,
    "OSVersion": null,
    "OSPlatform": null,
    "LoggedOnUsers": "[{\\"UserName\\":\\"bob\\",\\"DomainName\\":\\"DESKTOP-BOB\\",\\"Sid\\":\\"S-1-5-21-1695909852-106810125-1651530144-1001\\"}]",
    "AdditionalFields": "{\\"IsLocalLogon\\":true}",
    "DeviceObjectId": null,
    "DeviceId": "e93c25ad74cc1dd30afeb642696a2559824589e5",
    "MachineGroup": null,
    "Timestamp": "2021-07-16T09:54:41.0662159Z",
    "DeviceName": "desktop-dummy",
    "ReportId": 193010,
    "ClientVersion": "10.7431.19041.746"
  }
}

字段映射参考

本部分介绍 Google Security Operations 解析器如何将 Microsoft Defender for Endpoint 字段映射到 Google Security Operations UDM 字段。

字段映射参考信息：MICROSOFT DEFENDER ENDPOINT - UDM 事件模型的通用字段

下表列出了 MICROSOFT_DEFENDER_ENDPOINT 日志类型的常见日志字段及其对应的 UDM 字段：

Common log field UDM mapping Logic
time metadata.collected_timestamp
category metadata.product_event_type
metadata.product_name The metadata.product_name UDM field is set to Microsoft Defender for Endpoint.
metadata.vendor_name The metadata.vendor_name UDM field is set to Microsoft.
Tenant observer.resource_ancestors.name
tenantId observer.resource_ancestors.product_object_id
operationName additional.fields[operation_name]
properties.ActionType security_result.summary

字段映射参考信息：MICROSOFT DEFENDER ENDPOINT - UDM 实体模型的通用字段

下表列出了 MICROSOFT_DEFENDER_ENDPOINT 日志类型的常见日志字段及其对应的 UDM 字段：

Common log field UDM mapping Logic
metadata.vendor_name The metadata.vendor_name UDM field is set to Microsoft.
metadata.product_name The metadata.product_name UDM field is set to Microsoft Defender for Endpoint.
time metadata.collected_timestamp
tenantId relations.entity.resource.product_object_id
operationName additional.fields[operation_name]
category metadata.description
Tenant relations.entity.resource.name
relations.entity_type The relations.entity_type UDM field is set to RESOURCE.
relations.relationship The relations.relationship UDM field is set to MEMBER.
relations.direction The relations.direction UDM field is set to UNIDIRECTIONAL.

字段映射参考信息：DeviceEvents 事件标识符到事件类型

下表列出了 DeviceEvents 日志操作类型及其对应的 UDM 事件类型。

Event Identifier Event Type
AntivirusDefinitionsUpdated SCAN_HOST
AntivirusDefinitionsUpdateFailed SETTING_MODIFICATION
AntivirusDetection SCAN_HOST
AntivirusDetectionActionType SCAN_HOST
AntivirusEmergencyUpdatesInstalled SETTING_MODIFICATION
AntivirusError SCAN_HOST
AntivirusMalwareActionFailed SCAN_HOST
AntivirusMalwareBlocked SCAN_HOST
AntivirusReport SCAN_HOST
AntivirusScanCancelled SCAN_HOST
AntivirusScanCompleted SCAN_HOST
AntivirusScanFailed SCAN_HOST
AntivirusTroubleshootModeEvent STATUS_UPDATE
AppControlAppInstallationAudited SCAN_HOST
AppControlAppInstallationBlocked SCAN_HOST
AppControlCIScriptAudited SCAN_HOST
AppControlCIScriptBlocked SCAN_HOST
AppControlCodeIntegrityDriverRevoked SCAN_FILE
AppControlCodeIntegrityImageAudited SCAN_FILE
AppControlCodeIntegrityImageRevoked SCAN_FILE
AppControlCodeIntegrityOriginAllowed SCAN_FILE
AppControlCodeIntegrityOriginAudited SCAN_FILE
AppControlCodeIntegrityOriginBlocked SCAN_FILE
AppControlCodeIntegrityPolicyAudited SCAN_FILE
AppControlCodeIntegrityPolicyBlocked SCAN_FILE
AppControlCodeIntegrityPolicyLoaded SCAN_FILE
AppControlCodeIntegritySigningInformation GENERIC_EVENT
AppControlExecutableAudited SCAN_HOST
AppControlExecutableBlocked SCAN_HOST
AppControlPackagedAppAudited SCAN_HOST
AppControlPackagedAppBlocked SCAN_HOST
AppControlPolicyApplied SETTING_MODIFICATION
AppControlScriptAudited SCAN_HOST
AppControlScriptBlocked SCAN_HOST
AppGuardBrowseToUrl NETWORK_UNCATEGORIZED
AppGuardCreateContainer PROCESS_LAUNCH
AppGuardLaunchedWithUrl PROCESS_LAUNCH
AppGuardResumeContainer PROCESS_UNCATEGORIZED
AppGuardStopContainer PROCESS_TERMINATION
AppGuardSuspendContainer PROCESS_UNCATEGORIZED
AppLockerBlockExecutable SCAN_HOST
AppLockerBlockPackagedApp SCAN_HOST
AppLockerBlockPackagedAppInstallation SCAN_HOST
AppLockerBlockScript SCAN_HOST
AsrAbusedSystemToolAudited SCAN_HOST
AsrAbusedSystemToolBlocked SCAN_HOST
AsrAbusedSystemToolWarnBypassed SCAN_HOST
AsrAdobeReaderChildProcessAudited SCAN_HOST
AsrAdobeReaderChildProcessBlocked SCAN_HOST
AsrAdobeReaderChildProcessWarnBypassed SCAN_HOST
AsrExecutableEmailContentAudited SCAN_HOST
AsrExecutableEmailContentBlocked SCAN_HOST
AsrExecutableEmailContentWarnBypassed SCAN_HOST
AsrExecutableOfficeContentAudited SCAN_HOST
AsrExecutableOfficeContentBlocked SCAN_HOST
AsrExecutableOfficeContentWarnBypassed SCAN_HOST
AsrLsassCredentialTheftAudited SCAN_HOST
AsrLsassCredentialTheftBlocked SCAN_HOST
AsrLsassCredentialTheftWarnBypassed SCAN_HOST
AsrObfuscatedScriptAudited SCAN_HOST
AsrObfuscatedScriptBlocked SCAN_HOST
AsrObfuscatedScriptWarnBypassed SCAN_HOST
AsrOfficeChildProcessAudited SCAN_HOST
AsrOfficeChildProcessBlocked SCAN_HOST
AsrOfficeChildProcessWarnBypassed SCAN_HOST
AsrOfficeCommAppChildProcessAudited SCAN_HOST
AsrOfficeCommAppChildProcessBlocked SCAN_HOST
AsrOfficeCommAppChildProcessWarnBypassed SCAN_HOST
AsrOfficeMacroWin32ApiCallsAudited SCAN_HOST
AsrOfficeMacroWin32ApiCallsBlocked SCAN_HOST
AsrOfficeMacroWin32ApiCallsWarnBypassed SCAN_HOST
AsrOfficeProcessInjectionAudited SCAN_HOST
AsrOfficeProcessInjectionBlocked SCAN_HOST
AsrOfficeProcessInjectionWarnBypassed SCAN_HOST
AsrPersistenceThroughWmiAudited SCAN_HOST
AsrPersistenceThroughWmiBlocked SCAN_HOST
AsrPersistenceThroughWmiWarnBypassed SCAN_HOST
AsrPsexecWmiChildProcessAudited SCAN_HOST
AsrPsexecWmiChildProcessBlocked SCAN_HOST
AsrPsexecWmiChildProcessWarnBypassed SCAN_HOST
AsrRansomwareAudited SCAN_HOST
AsrRansomwareBlocked SCAN_HOST
AsrRansomwareWarnBypassed SCAN_HOST
AsrSafeModeRebootAudited SCAN_HOST
AsrSafeModeRebootBlocked SCAN_HOST
AsrSafeModeRebootWarnBypassed SCAN_HOST
AsrScriptExecutableDownloadAudited SCAN_HOST
AsrScriptExecutableDownloadBlocked SCAN_HOST
AsrScriptExecutableDownloadWarnBypassed SCAN_HOST
AsrUntrustedExecutableAudited SCAN_HOST
AsrUntrustedExecutableBlocked SCAN_HOST
AsrUntrustedExecutableWarnBypassed SCAN_HOST
AsrUntrustedUsbProcessAudited SCAN_HOST
AsrUntrustedUsbProcessBlocked SCAN_HOST
AsrUntrustedUsbProcessWarnBypassed SCAN_HOST
AsrVulnerableSignedDriverAudited SCAN_HOST
AsrVulnerableSignedDriverBlocked SCAN_HOST
AsrVulnerableSignedDriverWarnBypassed SCAN_HOST
AsrWebShellOnServerAudited SCAN_HOST
AsrWebShellOnServerBlocked SCAN_HOST
AsrWebShellWarnBypassed SCAN_HOST
AuditPolicyModification SETTING_MODIFICATION
BitLockerAuditCompleted STATUS_UPDATE
BluetoothPolicyTriggered SCAN_HOST
BrowserLaunchedToOpenUrl NETWORK_UNCATEGORIZED
BruteForceActivityDetected USER_LOGIN
ClrUnbackedModuleLoaded PROCESS_MODULE_LOAD
ContainedDeviceConnectionBlocked NETWORK_CONNECTION
ControlFlowGuardViolation SCAN_HOST
ControlledFolderAccessViolationAudited SCAN_FILE
ControlledFolderAccessViolationBlocked SCAN_FILE
CreateRemoteThreadApiCall PROCESS_UNCATEGORIZED
CredentialsBackup SERVICE_START
DeviceBootAttestationInfo GENERIC_EVENT
DirectoryServiceObjectCreated RESOURCE_CREATION
DirectoryServiceObjectModified RESOURCE_WRITTEN
DlpPocPrintJob FILE_UNCATEGORIZED
DnsQueryRequest NETWORK_DNS
DnsQueryResponse NETWORK_DNS
DpapiAccessed PROCESS_UNCATEGORIZED
DriverLoad PROCESS_MODULE_LOAD
ExploitGuardAcgAudited SCAN_HOST
ExploitGuardAcgEnforced SCAN_HOST
ExploitGuardChildProcessAudited SCAN_HOST
ExploitGuardChildProcessBlocked SCAN_HOST
ExploitGuardEafViolationAudited SCAN_HOST
ExploitGuardEafViolationBlocked SCAN_HOST
ExploitGuardIafViolationAudited SCAN_HOST
ExploitGuardIafViolationBlocked SCAN_HOST
ExploitGuardLowIntegrityImageAudited SCAN_HOST
ExploitGuardLowIntegrityImageBlocked SCAN_HOST
ExploitGuardNetworkProtectionAudited SCAN_HOST
ExploitGuardNetworkProtectionBlocked SCAN_HOST
ExploitGuardNonMicrosoftSignedAudited SCAN_HOST
ExploitGuardNonMicrosoftSignedBlocked SCAN_HOST
ExploitGuardRopExploitAudited SCAN_HOST
ExploitGuardRopExploitBlocked SCAN_HOST
ExploitGuardSharedBinaryAudited SCAN_HOST
ExploitGuardSharedBinaryBlocked SCAN_HOST
ExploitGuardWin32SystemCallAudited SCAN_HOST
ExploitGuardWin32SystemCallBlocked SCAN_HOST
FileTimestampModificationEvent FILE_MODIFICATION
FirewallInboundConnectionBlocked NETWORK_CONNECTION
FirewallInboundConnectionToAppBlocked NETWORK_CONNECTION
FirewallOutboundConnectionBlocked NETWORK_CONNECTION
FirewallServiceStopped SERVICE_STOP
GetAsyncKeyStateApiCall PROCESS_UNCATEGORIZED
GetClipboardData PROCESS_UNCATEGORIZED
LdapSearch RESOURCE_READ
LogonRightsSettingEnabled USER_CHANGE_PERMISSIONS
MemoryRemoteProtect PROCESS_UNCATEGORIZED
NamedPipeEvent PROCESS_UNCATEGORIZED
NetworkProtectionUserBypassEvent NETWORK_UNCATEGORIZED
NetworkShareObjectAccessChecked RESOURCE_READ
NetworkShareObjectAdded RESOURCE_CREATION
NetworkShareObjectDeleted RESOURCE_DELETION
NetworkShareObjectModified RESOURCE_WRITTEN
NtAllocateVirtualMemoryApiCall PROCESS_UNCATEGORIZED
NtAllocateVirtualMemoryRemoteApiCall PROCESS_UNCATEGORIZED
NtMapViewOfSectionRemoteApiCall PROCESS_UNCATEGORIZED
NtProtectVirtualMemoryApiCall PROCESS_UNCATEGORIZED
OpenProcessApiCall PROCESS_OPEN
OtherAlertRelatedActivity STATUS_UPDATE
PasswordChangeAttempt USER_CHANGE_PASSWORD
PlistPropertyModified FILE_MODIFICATION
PnpDeviceAllowed SCAN_HOST
PnpDeviceBlocked SCAN_HOST
PnpDeviceConnected DEVICE_CONFIG_UPDATE
PowerShellCommand PROCESS_LAUNCH
PrintJobBlocked SCAN_UNCATEGORIZED
ProcessCreatedUsingWmiQuery PROCESS_LAUNCH
ProcessPrimaryTokenModified PROCESS_UNCATEGORIZED
PTraceDetected PROCESS_UNCATEGORIZED
QueueUserApcRemoteApiCall PROCESS_UNCATEGORIZED
ReadProcessMemoryApiCall PROCESS_UNCATEGORIZED
RemoteDesktopConnection NETWORK_CONNECTION
RemoteWmiOperation PROCESS_UNCATEGORIZED
RemovableStorageFileEvent FILE_UNCATEGORIZED
RemovableStoragePolicyTriggered PROCESS_UNCATEGORIZED
SafeDocFileScan SCAN_FILE
ScheduledTaskCreated SCHEDULED_TASK_CREATION
ScheduledTaskDeleted SCHEDULED_TASK_DELETION
ScheduledTaskDisabled SCHEDULED_TASK_DISABLE
ScheduledTaskEnabled SCHEDULED_TASK_ENABLE
ScheduledTaskUpdated SCHEDULED_TASK_MODIFICATION
ScreenshotTaken GENERIC_EVENT
ScriptContent PROCESS_LAUNCH
SecurityGroupCreated GROUP_CREATION
SecurityGroupDeleted GROUP_DELETION
SecurityLogCleared SYSTEM_AUDIT_LOG_WIPE
SensitiveFileRead FILE_READ
ServiceInstalled SERVICE_CREATION
SetThreadContextRemoteApiCall PROCESS_UNCATEGORIZED
ShellLinkCreateFileEvent FILE_CREATION
SmartScreenAppWarning SCAN_HOST
SmartScreenExploitWarning SCAN_HOST
SmartScreenUrlWarning SCAN_HOST
SmartScreenUserOverride SETTING_MODIFICATION
TamperingAttempt SETTING_MODIFICATION
TvmAxonTelemetryEvent STATUS_UPDATE
UntrustedWifiConnection NETWORK_CONNECTION
UsbDriveDriveLetterChanged DEVICE_CONFIG_UPDATE
UsbDriveMounted DEVICE_CONFIG_UPDATE
UsbDriveUnmounted DEVICE_CONFIG_UPDATE
UserAccountAddedToLocalGroup GROUP_MODIFICATION
UserAccountCreated USER_CREATION
UserAccountDeleted USER_DELETION
UserAccountModified USER_UNCATEGORIZED
UserAccountRemovedFromLocalGroup GROUP_MODIFICATION
WmiBindEventFilterToConsumer PROCESS_UNCATEGORIZED
WriteProcessMemoryApiCall PROCESS_UNCATEGORIZED
WriteToLsassProcessMemory PROCESS_UNCATEGORIZED
AccountCheckedForBlankPassword SCAN_UNCATEGORIZED
AmsiScriptDetection PROCESS_UNCATEGORIZED

字段映射参考信息：MICROSOFT DEFENDER ENDPOINT - DeviceEvents

下表列出了 DeviceEvents 日志类型的日志字段及其对应的 UDM 字段：

Log field UDM mapping Logic
properties.Timestamp metadata.event_timestamp
properties.ActionType metadata.event_type
properties.ReportId metadata.product_log_id
properties.LogonId network.session_id
properties.InitiatingProcessSessionId additional.fields[initiating_process_session_id]
properties.IsInitiatingProcessRemoteSession additional.fields[is_initiating_process_remote_session]
properties.InitiatingProcessRemoteSessionIP src.ip
properties.InitiatingProcessRemoteSessionIP src.asset.ip
properties.ProcessRemoteSessionIP src.ip
properties.ProcessRemoteSessionIP src.asset.ip
properties.CreatedProcessSessionId additional.fields[created_process_session_id]
properties.IsProcessRemoteSession additional.fields[is_process_remote_session]
extensions.auth.mechanism The extensions.auth.mechanism UDM field is set to MECHANISM_UNSPECIFIED.
properties.InitiatingProcessRemoteSessionDeviceName src.hostname If properties.InitiatingProcessRemoteSessionDeviceName log field is not empty, then properties.InitiatingProcessRemoteSessionDeviceName log field is mapped to src.hostname UDM field.
properties.InitiatingProcessRemoteSessionDeviceName src.asset.hostname If properties.InitiatingProcessRemoteSessionDeviceName log field is not empty, then properties.InitiatingProcessRemoteSessionDeviceName log field is mapped to src.asset.hostname UDM field.
properties.ProcessRemoteSessionDeviceName src.hostname If properties.InitiatingProcessRemoteSessionDeviceName log field is empty, then properties.ProcessRemoteSessionDeviceName log field is mapped to src.hostname UDM field.
properties.ProcessRemoteSessionDeviceName src.asset.hostname If properties.InitiatingProcessRemoteSessionDeviceName log field is empty, then properties.ProcessRemoteSessionDeviceName log field is mapped to src.asset.hostname UDM field.
properties.ActionType network.application_protocol If the properties.ActionType log field contains one of the following values, then the network.application_protocol UDM field is set to DNS:
  • DnsQueryRequest
  • DnsQueryResponse
target.resource.resource_type If the properties.ActionType log field contains one of the following values:
  • AntivirusDefinitionsUpdateFailed
  • AntivirusEmergencyUpdatesInstalled
  • AppControlPolicyApplied
  • AuditPolicyModification
  • FirewallServiceStopped
  • SmartScreenUserOverride
  • TamperingAttempt
then the target.resource.resource_type UDM field is set to SETTING.
Otherwise, if the properties.ActionType log field contains one of the following values:
  • ScheduledTaskCreated
  • ScheduledTaskDeleted
  • ScheduledTaskDisabled
  • ScheduledTaskEnabled
  • ScheduledTaskUpdated
then the target.resource.resource_type UDM field is set to TASK.
Otherwise, if the properties.ActionType log field contains one of the following values:
  • DirectoryServiceObjectCreated
  • DirectoryServiceObjectModified
  • NetworkShareObjectAccessChecked
  • NetworkShareObjectAdded
  • NetworkShareObjectDeleted
  • NetworkShareObjectModified
then the target.resource.resource_type UDM field is set to STORAGE_OBJECT.
Otherwise, if the properties.ActionType log field contains one of the following values:
  • ExploitGuardNetworkProtectionAudited
  • ExploitGuardNetworkProtectionBlocked
  • AsrOfficeProcessInjectionAudited
  • AsrExecutableEmailContentAudited
  • AsrExecutableOfficeContentAudited
  • AsrOfficeChildProcessAudited
  • AsrOfficeCommAppChildProcessAudited
  • AsrPsexecWmiChildProcessAudited
  • AsrScriptExecutableDownloadAudited
  • AsrUntrustedExecutableAudited
  • AsrUntrustedUsbProcessAudited
  • AsrWebShellOnServerAudited
  • ExploitGuardChildProcessAudited
  • ExploitGuardLowIntegrityImageAudited
  • ExploitGuardNonMicrosoftSignedAudited
  • ExploitGuardSharedBinaryAudited
  • AppControlCIScriptBlocked
  • AppControlExecutableBlocked
  • AppControlPackagedAppBlocked
  • AppControlScriptBlocked
  • AppLockerBlockExecutable
  • AppLockerBlockPackagedApp
  • AppLockerBlockPackagedAppInstallation
  • AppLockerBlockScript
  • AsrAbusedSystemToolBlocked
  • AsrAdobeReaderChildProcessBlocked
  • AsrExecutableEmailContentBlocked
  • AsrExecutableOfficeContentBlocked
  • AsrLsassCredentialTheftBlocked
  • AsrObfuscatedScriptBlocked
  • AsrOfficeChildProcessBlocked
  • AsrOfficeCommAppChildProcessBlocked
  • AsrOfficeMacroWin32ApiCallsBlocked
  • AsrOfficeProcessInjectionBlocked
  • AsrPersistenceThroughWmiBlocked
  • AsrPsexecWmiChildProcessBlocked
  • AsrRansomwareBlocked
  • AsrSafeModeRebootBlocked
  • AsrScriptExecutableDownloadBlocked
  • AsrUntrustedExecutableBlocked
  • AsrUntrustedUsbProcessBlocked
  • AsrVulnerableSignedDriverBlocked
  • AsrWebShellOnServerBlocked
  • ControlFlowGuardViolation
  • ExploitGuardAcgEnforced
  • ExploitGuardChildProcessBlocked
  • ExploitGuardEafViolationBlocked
  • ExploitGuardIafViolationBlocked
  • ExploitGuardLowIntegrityImageBlocked
  • ExploitGuardNonMicrosoftSignedBlocked
  • ExploitGuardRopExploitBlocked
  • ExploitGuardSharedBinaryBlocked
  • ExploitGuardWin32SystemCallBlocked
  • AppControlAppInstallationBlocked
  • AppControlAppInstallationAudited
  • AppControlCIScriptAudited
  • AppControlExecutableAudited
  • AppControlPackagedAppAudited
  • AppControlScriptAudited
  • AsrAbusedSystemToolAudited
  • AsrAdobeReaderChildProcessAudited
  • AsrLsassCredentialTheftAudited
  • AsrObfuscatedScriptAudited
  • AsrOfficeMacroWin32ApiCallsAudited
  • AsrPersistenceThroughWmiAudited
  • AsrRansomwareAudited
  • AsrSafeModeRebootAudited
  • AsrVulnerableSignedDriverAudited
  • ExploitGuardEafViolationAudited
  • ExploitGuardIafViolationAudited
  • ExploitGuardRopExploitAudited
  • ExploitGuardWin32SystemCallAudited
  • ExploitGuardAcgAudited
  • PnpDeviceAllowed
  • PnpDeviceBlocked
  • AntivirusDetection
  • AntivirusDetectionActionType
  • AntivirusMalwareActionFailed
  • AntivirusMalwareBlocked
  • AntivirusReport
  • AntivirusScanCancelled
  • AntivirusScanCompleted
  • AntivirusScanFailed
  • SmartScreenAppWarning
  • SmartScreenExploitWarning
  • SmartScreenUrlWarning
  • AntivirusError
  • AntivirusDefinitionsUpdated
  • AsrAbusedSystemToolWarnBypassed
  • AsrAdobeReaderChildProcessWarnBypassed
  • AsrExecutableEmailContentWarnBypassed
  • AsrExecutableOfficeContentWarnBypassed
  • AsrLsassCredentialTheftWarnBypassed
  • AsrObfuscatedScriptWarnBypassed
  • AsrOfficeChildProcessWarnBypassed
  • AsrOfficeCommAppChildProcessWarnBypassed
  • AsrOfficeMacroWin32ApiCallsWarnBypassed
  • AsrOfficeProcessInjectionWarnBypassed
  • AsrPersistenceThroughWmiWarnBypassed
  • AsrPsexecWmiChildProcessWarnBypassed
  • AsrRansomwareWarnBypassed
  • AsrSafeModeRebootWarnBypassed
  • AsrScriptExecutableDownloadWarnBypassed
  • AsrUntrustedExecutableWarnBypassed
  • AsrUntrustedUsbProcessWarnBypassed
  • AsrVulnerableSignedDriverWarnBypassed
  • AsrWebShellWarnBypassed
  • BluetoothPolicyTriggered
  • PnpDeviceConnected
then the target.resource.resource_type UDM field is set to DEVICE.
properties.DeviceId principal.asset_id If the properties.ActionType log field contains one of the following values, then DeviceID:%{properties.DeviceId} is mapped to the target.asset_id and target.asset.asset_id UDM field:
  • RemoteWmiOperation
  • ProcessCreatedUsingWmiQuery
Otherwise, DeviceID:%{properties.DeviceId} is mapped to the principal.asset_id and principal.asset.asset_id UDM fields.
properties.DeviceId principal.asset.asset_id If the properties.ActionType log field contains one of the following values, then DeviceID:%{properties.DeviceId} is mapped to the target.asset_id and target.asset.asset_id UDM field:
  • RemoteWmiOperation
  • ProcessCreatedUsingWmiQuery
Otherwise, DeviceID:%{properties.DeviceId} is mapped to the principal.asset_id and principal.asset.asset_id UDM fields.
properties.DeviceId target.asset_id If the properties.ActionType log field contains one of the following values, then DeviceID:%{properties.DeviceId} is mapped to the target.asset_id and target.asset.asset_id UDM field:
  • RemoteWmiOperation
  • ProcessCreatedUsingWmiQuery
Otherwise, DeviceID:%{properties.DeviceId} is mapped to the principal.asset_id and principal.asset.asset_id UDM fields.
properties.DeviceId target.asset.asset_id If the properties.ActionType log field contains one of the following values, then DeviceID:%{properties.DeviceId} is mapped to the target.asset_id and target.asset.asset_id UDM field:
  • RemoteWmiOperation
  • ProcessCreatedUsingWmiQuery
Otherwise, DeviceID:%{properties.DeviceId} is mapped to the principal.asset_id and principal.asset.asset_id UDM fields.
properties.InitiatingProcessAccountDomain principal.administrative_domain If the properties.ActionType log field contains one of the following values and the properties.InitiatingProcessAccountDomain log field value is not empty, then the properties.InitiatingProcessAccountDomain log field is mapped to the target.administrative_domain UDM field:
  • RemoteWmiOperation
  • ProcessCreatedUsingWmiQuery
Otherwise, if the properties.InitiatingProcessAccountDomain log field value is not empty, then the properties.InitiatingProcessAccountDomain log field is mapped to the principal.administrative_domain UDM field.
properties.InitiatingProcessAccountDomain target.administrative_domain If the properties.ActionType log field contains one of the following values and the properties.InitiatingProcessAccountDomain log field value is not empty, then the properties.InitiatingProcessAccountDomain log field is mapped to the target.administrative_domain UDM field:
  • RemoteWmiOperation
  • ProcessCreatedUsingWmiQuery
Otherwise, if the properties.InitiatingProcessAccountDomain log field value is not empty, then the properties.InitiatingProcessAccountDomain log field is mapped to the principal.administrative_domain UDM field.
properties.AccountDomain principal.administrative_domain If the properties.ActionType log field contains one of the following values:
  • BruteForceActivityDetected
  • LogonRightsSettingEnabled
  • PasswordChangeAttempt
  • UserAccountCreated
  • UserAccountDeleted
  • UserAccountModified
then if the properties.AccountDomain log field is not empty, then it is mapped to the target.administrative_domain UDM field.

Otherwise, if the properties.InitiatingProcessAccountDomain log field is not empty and the properties.AccountDomain log field is not empty, then the properties.AccountDomain log field is mapped to additional.fields[AccountDomain].

Otherwise, if the properties.InitiatingProcessAccountDomain log field is empty and the properties.AccountDomain log field is not empty, then the properties.AccountDomain log field is mapped to the principal.administrative_domain UDM field.
properties.AccountDomain target.administrative_domain If the properties.ActionType log field contains one of the following values:
  • BruteForceActivityDetected
  • LogonRightsSettingEnabled
  • PasswordChangeAttempt
  • UserAccountCreated
  • UserAccountDeleted
  • UserAccountModified
then if the properties.AccountDomain log field is not empty, then it is mapped to the target.administrative_domain UDM field.

Otherwise, if the properties.InitiatingProcessAccountDomain log field is not empty and the properties.AccountDomain log field is not empty, then the properties.AccountDomain log field is mapped to additional.fields[AccountDomain].

Otherwise, if the properties.InitiatingProcessAccountDomain log field is empty and the properties.AccountDomain log field is not empty, then the properties.AccountDomain log field is mapped to the principal.administrative_domain UDM field.
properties.DeviceName principal.hostname If the properties.ActionType log field contains one of the following values, then the properties.DeviceName log field is mapped to the target.hostname and target.asset.hostname UDM field:
  • RemoteWmiOperation
  • ProcessCreatedUsingWmiQuery
Otherwise, the properties.DeviceName log field is mapped to the principal.hostname and principal.asset.hostname UDM fields.
properties.DeviceName principal.asset.hostname If the properties.ActionType log field contains one of the following values, then the properties.DeviceName log field is mapped to the target.hostname and target.asset.hostname UDM field:
  • RemoteWmiOperation
  • ProcessCreatedUsingWmiQuery
Otherwise, the properties.DeviceName log field is mapped to the principal.hostname and principal.asset.hostname UDM fields.
properties.DeviceName target.hostname If the properties.ActionType log field contains one of the following values, then the properties.DeviceName log field is mapped to the target.hostname and target.asset.hostname UDM field:
  • RemoteWmiOperation
  • ProcessCreatedUsingWmiQuery
Otherwise, the properties.DeviceName log field is mapped to the principal.hostname and principal.asset.hostname UDM fields.
properties.DeviceName target.asset.hostname If the properties.ActionType log field contains one of the following values, then the properties.DeviceName log field is mapped to the target.hostname and target.asset.hostname UDM field:
  • RemoteWmiOperation
  • ProcessCreatedUsingWmiQuery
Otherwise, the properties.DeviceName log field is mapped to the principal.hostname and principal.asset.hostname UDM fields.
properties.LocalIP principal.ip If the properties.ActionType log field contains one of the following values, then the properties.LocalIP log field is mapped to the target.ip and target.asset.ip UDM field:
  • RemoteWmiOperation
  • ProcessCreatedUsingWmiQuery
Otherwise, the properties.LocalIP log field is mapped to the principal.ip and principal.asset.ip UDM fields.
properties.LocalIP principal.asset.ip If the properties.ActionType log field contains one of the following values, then the properties.LocalIP log field is mapped to the target.ip and target.asset.ip UDM field:
  • RemoteWmiOperation
  • ProcessCreatedUsingWmiQuery
Otherwise, the properties.LocalIP log field is mapped to the principal.ip and principal.asset.ip UDM fields.
properties.LocalIP target.ip If the properties.ActionType log field contains one of the following values, then the properties.LocalIP log field is mapped to the target.ip and target.asset.ip UDM field:
  • RemoteWmiOperation
  • ProcessCreatedUsingWmiQuery
Otherwise, the properties.LocalIP log field is mapped to the principal.ip and principal.asset.ip UDM fields.
properties.LocalIP target.asset.ip If the properties.ActionType log field contains one of the following values, then the properties.LocalIP log field is mapped to the target.ip and target.asset.ip UDM field:
  • RemoteWmiOperation
  • ProcessCreatedUsingWmiQuery
Otherwise, the properties.LocalIP log field is mapped to the principal.ip and principal.asset.ip UDM fields.
properties.FileOriginIP principal.ip
properties.FileOriginIP principal.asset.ip
properties.LocalPort principal.port If the properties.ActionType log field contains one of the following values, then the properties.LocalPort log field is mapped to the target.port UDM field:
  • RemoteWmiOperation
  • ProcessCreatedUsingWmiQuery
Otherwise, the properties.LocalPort log field is mapped to the principal.port UDM field.
properties.LocalPort target.port If the properties.ActionType log field contains one of the following values, then the properties.LocalPort log field is mapped to the target.port UDM field:
  • RemoteWmiOperation
  • ProcessCreatedUsingWmiQuery
Otherwise, the properties.LocalPort log field is mapped to the principal.port UDM field.
properties.InitiatingProcessCommandLine principal.process.command_line
properties.InitiatingProcessFolderPath principal.process.file.full_path If the properties.InitiatingProcessFolderPath log field value matches the regular expression pattern the properties.InitiatingProcessFileName log field value, then the properties.InitiatingProcessFolderPath log field is mapped to the principal.process.file.full_path UDM field.

Otherwise, the principal.process.file.full_path is set to %{properties.InitiatingProcessFolderPath}/%{properties.InitiatingProcessFileName}.
properties.InitiatingProcessMD5 principal.process.file.md5 If the properties.InitiatingProcessMD5 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.InitiatingProcessMD5 log field is mapped to the principal.process.file.md5 UDM field.
properties.InitiatingProcessFileName principal.process.file.names
properties.InitiatingProcessSHA1 principal.process.file.sha1 If the properties.InitiatingProcessSHA1 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.InitiatingProcessSHA1 log field is mapped to the principal.process.file.sha1 UDM field.
properties.InitiatingProcessSHA256 principal.process.file.sha256 If the properties.InitiatingProcessSHA256 log field value matches the regular expression pattern ^[a-f0-9]{64}$, then the properties.InitiatingProcessSHA256 log field is mapped to the principal.process.file.sha256 UDM field.
properties.InitiatingProcessFileSize principal.process.file.size
properties.InitiatingProcessParentFileName principal.process.parent_process.file.names
properties.InitiatingProcessParentId principal.process.parent_process.pid
properties.InitiatingProcessId principal.process.pid
properties.FileOriginUrl principal.url
properties.InitiatingProcessAccountObjectId principal.user.product_object_id
properties.InitiatingProcessAccountUpn principal.user.user_display_name
properties.InitiatingProcessAccountName principal.user.userid
properties.AccountName principal.user.userid If the properties.ActionType log field contains one of the following values:
  • BruteForceActivityDetected
  • LogonRightsSettingEnabled
  • PasswordChangeAttempt
  • UserAccountCreated
  • UserAccountDeleted
  • UserAccountModified
then if the properties.AccountName log field is not empty, then it is mapped to the target.user.userid UDM field.

Otherwise, if the properties.InitiatingProcessAccountName log field is not empty and the properties.AccountName log field is not empty, then the properties.AccountName log field is mapped to additional.fields[AccountName].

Otherwise, if the properties.InitiatingProcessAccountName log field is empty and the properties.AccountName log field is not empty, then the properties.AccountName log field is mapped to the principal.user.userid UDM field.
properties.AccountName target.user.userid If the properties.ActionType log field contains one of the following values:
  • BruteForceActivityDetected
  • LogonRightsSettingEnabled
  • PasswordChangeAttempt
  • UserAccountCreated
  • UserAccountDeleted
  • UserAccountModified
then if the properties.AccountName log field is not empty, then it is mapped to the target.user.userid UDM field.

Otherwise, if the properties.InitiatingProcessAccountName log field is not empty and the properties.AccountName log field is not empty, then the properties.AccountName log field is mapped to additional.fields[AccountName].

Otherwise, if the properties.InitiatingProcessAccountName log field is empty and the properties.AccountName log field is not empty, then the properties.AccountName log field is mapped to the principal.user.userid UDM field.
properties.InitiatingProcessAccountSid principal.user.windows_sid
properties.AccountSid principal.user.windows_sid If the properties.ActionType log field contains one of the following values:
  • BruteForceActivityDetected
  • LogonRightsSettingEnabled
  • PasswordChangeAttempt
  • UserAccountCreated
  • UserAccountDeleted
  • UserAccountModified
then if the properties.AccountSid log field is not empty, then it is mapped to the target.user.windows_sid UDM field.

Otherwise, if the properties.InitiatingProcessAccountSid log field is not empty and the properties.AccountSid log field is not empty, then the properties.AccountSid log field is mapped to additional.fields[AccountSid].

Otherwise, if the properties.InitiatingProcessAccountSid log field is empty and the properties.AccountSid log field is not empty, then the properties.AccountSid log field is mapped to the principal.user.windows_sid UDM field.
properties.AccountSid target.user.windows_sid If the properties.ActionType log field contains one of the following values:
  • BruteForceActivityDetected
  • LogonRightsSettingEnabled
  • PasswordChangeAttempt
  • UserAccountCreated
  • UserAccountDeleted
  • UserAccountModified
then if the properties.AccountSid log field is not empty, then it is mapped to the target.user.windows_sid UDM field.

Otherwise, if the properties.InitiatingProcessAccountSid log field is not empty and the properties.AccountSid log field is not empty, then the properties.AccountSid log field is mapped to additional.fields[AccountSid].

Otherwise, if the properties.InitiatingProcessAccountSid log field is empty and the properties.AccountSid log field is not empty, then the properties.AccountSid log field is mapped to the principal.user.windows_sid UDM field.
properties.ActionType security_result.action If the properties.ActionType log field value matches the regular expression pattern (?i)Allow, then the security_result.action UDM field is set to ALLOW.

Otherwise, if the properties.ActionType log field value matches the regular expression pattern (?i)Block, then the security_result.action UDM field is set to BLOCK.

Otherwise, if the properties.ActionType log field value matches the regular expression pattern (?i)Fail, then the security_result.action UDM field is set to FAIL.
properties.FolderPath target.file.full_path If the properties.ActionType log field contains one of the following values:
  • AmsiScriptDetection
  • AppGuardCreateContainer
  • AppGuardLaunchedWithUrl
  • AppGuardResumeContainer
  • AppGuardStopContainer
  • AppGuardSuspendContainer
  • ClrUnbackedModuleLoaded
  • CreateRemoteThreadApiCall
  • DpapiAccessed
  • DriverLoad
  • GetAsyncKeyStateApiCall
  • GetClipboardData
  • MemoryRemoteProtect
  • NamedPipeEvent
  • NtAllocateVirtualMemoryApiCall
  • NtAllocateVirtualMemoryRemoteApiCall
  • NtMapViewOfSectionRemoteApiCall
  • NtProtectVirtualMemoryApiCall
  • OpenProcessApiCall
  • PowerShellCommand
  • ProcessCreatedUsingWmiQuery
  • ProcessPrimaryTokenModified
  • PTraceDetected
  • QueueUserApcRemoteApiCall
  • ReadProcessMemoryApiCall
  • RemoteWmiOperation
  • RemovableStoragePolicyTriggered
  • ScriptContent
  • SetThreadContextRemoteApiCall
  • WmiBindEventFilterToConsumer
  • WriteProcessMemoryApiCall
  • WriteToLsassProcessMemory
  • AsrAdobeReaderChildProcessAudited
  • AsrAdobeReaderChildProcessBlocked
  • AsrAdobeReaderChildProcessWarnBypassed
  • AsrOfficeChildProcessAudited
  • AsrOfficeChildProcessBlocked
  • AsrOfficeChildProcessWarnBypassed
  • AsrOfficeCommAppChildProcessAudited
  • AsrOfficeCommAppChildProcessBlocked
  • AsrOfficeCommAppChildProcessWarnBypassed
  • AsrOfficeProcessInjectionAudited
  • AsrOfficeProcessInjectionBlocked
  • AsrOfficeProcessInjectionWarnBypassed
  • AsrPsexecWmiChildProcessAudited
  • AsrPsexecWmiChildProcessBlocked
  • AsrPsexecWmiChildProcessWarnBypassed
  • AsrUntrustedUsbProcessAudited
  • AsrUntrustedUsbProcessBlocked
  • AsrUntrustedUsbProcessWarnBypassed
  • ExploitGuardChildProcessAudited
  • ExploitGuardChildProcessBlocked
then if the properties.FolderPath log field value matches the regular expression pattern the properties.FileName log field value , then properties.FolderPath log field is mapped to the target.process.file.full_path UDM field, otherwise %{properties.FolderPath}\%{properties.FileName} is mapped to the target.process.file.full_path UDM field.
Otherwise, if the properties.FolderPath log field value matches the regular expression pattern the properties.FileName log field value , then properties.FolderPath log field is mapped to the target.file.full_path UDM field, otherwise %{properties.FolderPath}\%{properties.FileName} is mapped to the target.file.full_path UDM field.
properties.FolderPath target.process.file.full_path If the properties.ActionType log field contains one of the following values:
  • AmsiScriptDetection
  • AppGuardCreateContainer
  • AppGuardLaunchedWithUrl
  • AppGuardResumeContainer
  • AppGuardStopContainer
  • AppGuardSuspendContainer
  • ClrUnbackedModuleLoaded
  • CreateRemoteThreadApiCall
  • DpapiAccessed
  • DriverLoad
  • GetAsyncKeyStateApiCall
  • GetClipboardData
  • MemoryRemoteProtect
  • NamedPipeEvent
  • NtAllocateVirtualMemoryApiCall
  • NtAllocateVirtualMemoryRemoteApiCall
  • NtMapViewOfSectionRemoteApiCall
  • NtProtectVirtualMemoryApiCall
  • OpenProcessApiCall
  • PowerShellCommand
  • ProcessCreatedUsingWmiQuery
  • ProcessPrimaryTokenModified
  • PTraceDetected
  • QueueUserApcRemoteApiCall
  • ReadProcessMemoryApiCall
  • RemoteWmiOperation
  • RemovableStoragePolicyTriggered
  • ScriptContent
  • SetThreadContextRemoteApiCall
  • WmiBindEventFilterToConsumer
  • WriteProcessMemoryApiCall
  • WriteToLsassProcessMemory
  • AsrAdobeReaderChildProcessAudited
  • AsrAdobeReaderChildProcessBlocked
  • AsrAdobeReaderChildProcessWarnBypassed
  • AsrOfficeChildProcessAudited
  • AsrOfficeChildProcessBlocked
  • AsrOfficeChildProcessWarnBypassed
  • AsrOfficeCommAppChildProcessAudited
  • AsrOfficeCommAppChildProcessBlocked
  • AsrOfficeCommAppChildProcessWarnBypassed
  • AsrOfficeProcessInjectionAudited
  • AsrOfficeProcessInjectionBlocked
  • AsrOfficeProcessInjectionWarnBypassed
  • AsrPsexecWmiChildProcessAudited
  • AsrPsexecWmiChildProcessBlocked
  • AsrPsexecWmiChildProcessWarnBypassed
  • AsrUntrustedUsbProcessAudited
  • AsrUntrustedUsbProcessBlocked
  • AsrUntrustedUsbProcessWarnBypassed
  • ExploitGuardChildProcessAudited
  • ExploitGuardChildProcessBlocked
then if the properties.FolderPath log field value matches the regular expression pattern the properties.FileName log field value , then properties.FolderPath log field is mapped to the target.process.file.full_path UDM field, otherwise %{properties.FolderPath}\%{properties.FileName} is mapped to the target.process.file.full_path UDM field.
Otherwise, if the properties.FolderPath log field value matches the regular expression pattern the properties.FileName log field value , then properties.FolderPath log field is mapped to the target.file.full_path UDM field, otherwise %{properties.FolderPath}\%{properties.FileName} is mapped to the target.file.full_path UDM field.
properties.MD5 target.file.md5 If the properties.ActionType log field contains one of the following values:
  • AmsiScriptDetection
  • AppGuardCreateContainer
  • AppGuardLaunchedWithUrl
  • AppGuardResumeContainer
  • AppGuardStopContainer
  • AppGuardSuspendContainer
  • ClrUnbackedModuleLoaded
  • CreateRemoteThreadApiCall
  • DpapiAccessed
  • DriverLoad
  • GetAsyncKeyStateApiCall
  • GetClipboardData
  • MemoryRemoteProtect
  • NamedPipeEvent
  • NtAllocateVirtualMemoryApiCall
  • NtAllocateVirtualMemoryRemoteApiCall
  • NtMapViewOfSectionRemoteApiCall
  • NtProtectVirtualMemoryApiCall
  • OpenProcessApiCall
  • PowerShellCommand
  • ProcessCreatedUsingWmiQuery
  • ProcessPrimaryTokenModified
  • PTraceDetected
  • QueueUserApcRemoteApiCall
  • ReadProcessMemoryApiCall
  • RemoteWmiOperation
  • RemovableStoragePolicyTriggered
  • ScriptContent
  • SetThreadContextRemoteApiCall
  • WmiBindEventFilterToConsumer
  • WriteProcessMemoryApiCall
  • WriteToLsassProcessMemory
  • AsrAdobeReaderChildProcessAudited
  • AsrAdobeReaderChildProcessBlocked
  • AsrAdobeReaderChildProcessWarnBypassed
  • AsrOfficeChildProcessAudited
  • AsrOfficeChildProcessBlocked
  • AsrOfficeChildProcessWarnBypassed
  • AsrOfficeCommAppChildProcessAudited
  • AsrOfficeCommAppChildProcessBlocked
  • AsrOfficeCommAppChildProcessWarnBypassed
  • AsrOfficeProcessInjectionAudited
  • AsrOfficeProcessInjectionBlocked
  • AsrOfficeProcessInjectionWarnBypassed
  • AsrPsexecWmiChildProcessAudited
  • AsrPsexecWmiChildProcessBlocked
  • AsrPsexecWmiChildProcessWarnBypassed
  • AsrUntrustedUsbProcessAudited
  • AsrUntrustedUsbProcessBlocked
  • AsrUntrustedUsbProcessWarnBypassed
  • ExploitGuardChildProcessAudited
  • ExploitGuardChildProcessBlocked
and if the properties.MD5 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.MD5 log field is mapped to the target.process.file.md5 UDM field.
Otherwise, if the properties.MD5 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.MD5 log field is mapped to the target.file.md5 UDM field.
properties.MD5 target.process.file.md5 If the properties.ActionType log field contains one of the following values:
  • AmsiScriptDetection
  • AppGuardCreateContainer
  • AppGuardLaunchedWithUrl
  • AppGuardResumeContainer
  • AppGuardStopContainer
  • AppGuardSuspendContainer
  • ClrUnbackedModuleLoaded
  • CreateRemoteThreadApiCall
  • DpapiAccessed
  • DriverLoad
  • GetAsyncKeyStateApiCall
  • GetClipboardData
  • MemoryRemoteProtect
  • NamedPipeEvent
  • NtAllocateVirtualMemoryApiCall
  • NtAllocateVirtualMemoryRemoteApiCall
  • NtMapViewOfSectionRemoteApiCall
  • NtProtectVirtualMemoryApiCall
  • OpenProcessApiCall
  • PowerShellCommand
  • ProcessCreatedUsingWmiQuery
  • ProcessPrimaryTokenModified
  • PTraceDetected
  • QueueUserApcRemoteApiCall
  • ReadProcessMemoryApiCall
  • RemoteWmiOperation
  • RemovableStoragePolicyTriggered
  • ScriptContent
  • SetThreadContextRemoteApiCall
  • WmiBindEventFilterToConsumer
  • WriteProcessMemoryApiCall
  • WriteToLsassProcessMemory
  • AsrAdobeReaderChildProcessAudited
  • AsrAdobeReaderChildProcessBlocked
  • AsrAdobeReaderChildProcessWarnBypassed
  • AsrOfficeChildProcessAudited
  • AsrOfficeChildProcessBlocked
  • AsrOfficeChildProcessWarnBypassed
  • AsrOfficeCommAppChildProcessAudited
  • AsrOfficeCommAppChildProcessBlocked
  • AsrOfficeCommAppChildProcessWarnBypassed
  • AsrOfficeProcessInjectionAudited
  • AsrOfficeProcessInjectionBlocked
  • AsrOfficeProcessInjectionWarnBypassed
  • AsrPsexecWmiChildProcessAudited
  • AsrPsexecWmiChildProcessBlocked
  • AsrPsexecWmiChildProcessWarnBypassed
  • AsrUntrustedUsbProcessAudited
  • AsrUntrustedUsbProcessBlocked
  • AsrUntrustedUsbProcessWarnBypassed
  • ExploitGuardChildProcessAudited
  • ExploitGuardChildProcessBlocked
and if the properties.MD5 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.MD5 log field is mapped to the target.process.file.md5 UDM field.
Otherwise, if the properties.MD5 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.MD5 log field is mapped to the target.file.md5 UDM field.
properties.FileName target.file.names If the properties.ActionType log field contains one of the following values:
  • AmsiScriptDetection
  • AppGuardCreateContainer
  • AppGuardLaunchedWithUrl
  • AppGuardResumeContainer
  • AppGuardStopContainer
  • AppGuardSuspendContainer
  • ClrUnbackedModuleLoaded
  • CreateRemoteThreadApiCall
  • DpapiAccessed
  • DriverLoad
  • GetAsyncKeyStateApiCall
  • GetClipboardData
  • MemoryRemoteProtect
  • NamedPipeEvent
  • NtAllocateVirtualMemoryApiCall
  • NtAllocateVirtualMemoryRemoteApiCall
  • NtMapViewOfSectionRemoteApiCall
  • NtProtectVirtualMemoryApiCall
  • OpenProcessApiCall
  • PowerShellCommand
  • ProcessCreatedUsingWmiQuery
  • ProcessPrimaryTokenModified
  • PTraceDetected
  • QueueUserApcRemoteApiCall
  • ReadProcessMemoryApiCall
  • RemoteWmiOperation
  • RemovableStoragePolicyTriggered
  • ScriptContent
  • SetThreadContextRemoteApiCall
  • WmiBindEventFilterToConsumer
  • WriteProcessMemoryApiCall
  • WriteToLsassProcessMemory
  • AsrAdobeReaderChildProcessAudited
  • AsrAdobeReaderChildProcessBlocked
  • AsrAdobeReaderChildProcessWarnBypassed
  • AsrOfficeChildProcessAudited
  • AsrOfficeChildProcessBlocked
  • AsrOfficeChildProcessWarnBypassed
  • AsrOfficeCommAppChildProcessAudited
  • AsrOfficeCommAppChildProcessBlocked
  • AsrOfficeCommAppChildProcessWarnBypassed
  • AsrOfficeProcessInjectionAudited
  • AsrOfficeProcessInjectionBlocked
  • AsrOfficeProcessInjectionWarnBypassed
  • AsrPsexecWmiChildProcessAudited
  • AsrPsexecWmiChildProcessBlocked
  • AsrPsexecWmiChildProcessWarnBypassed
  • AsrUntrustedUsbProcessAudited
  • AsrUntrustedUsbProcessBlocked
  • AsrUntrustedUsbProcessWarnBypassed
  • ExploitGuardChildProcessAudited
  • ExploitGuardChildProcessBlocked
then properties.FileName log field is mapped to the target.process.file.names UDM field.
Otherwise, properties.FileName log field is mapped to the target.file.names UDM field.
properties.FileName target.process.file.names If the properties.ActionType log field contains one of the following values:
  • AmsiScriptDetection
  • AppGuardCreateContainer
  • AppGuardLaunchedWithUrl
  • AppGuardResumeContainer
  • AppGuardStopContainer
  • AppGuardSuspendContainer
  • ClrUnbackedModuleLoaded
  • CreateRemoteThreadApiCall
  • DpapiAccessed
  • DriverLoad
  • GetAsyncKeyStateApiCall
  • GetClipboardData
  • MemoryRemoteProtect
  • NamedPipeEvent
  • NtAllocateVirtualMemoryApiCall
  • NtAllocateVirtualMemoryRemoteApiCall
  • NtMapViewOfSectionRemoteApiCall
  • NtProtectVirtualMemoryApiCall
  • OpenProcessApiCall
  • PowerShellCommand
  • ProcessCreatedUsingWmiQuery
  • ProcessPrimaryTokenModified
  • PTraceDetected
  • QueueUserApcRemoteApiCall
  • ReadProcessMemoryApiCall
  • RemoteWmiOperation
  • RemovableStoragePolicyTriggered
  • ScriptContent
  • SetThreadContextRemoteApiCall
  • WmiBindEventFilterToConsumer
  • WriteProcessMemoryApiCall
  • WriteToLsassProcessMemory
  • AsrAdobeReaderChildProcessAudited
  • AsrAdobeReaderChildProcessBlocked
  • AsrAdobeReaderChildProcessWarnBypassed
  • AsrOfficeChildProcessAudited
  • AsrOfficeChildProcessBlocked
  • AsrOfficeChildProcessWarnBypassed
  • AsrOfficeCommAppChildProcessAudited
  • AsrOfficeCommAppChildProcessBlocked
  • AsrOfficeCommAppChildProcessWarnBypassed
  • AsrOfficeProcessInjectionAudited
  • AsrOfficeProcessInjectionBlocked
  • AsrOfficeProcessInjectionWarnBypassed
  • AsrPsexecWmiChildProcessAudited
  • AsrPsexecWmiChildProcessBlocked
  • AsrPsexecWmiChildProcessWarnBypassed
  • AsrUntrustedUsbProcessAudited
  • AsrUntrustedUsbProcessBlocked
  • AsrUntrustedUsbProcessWarnBypassed
  • ExploitGuardChildProcessAudited
  • ExploitGuardChildProcessBlocked
then properties.FileName log field is mapped to the target.process.file.names UDM field.
Otherwise, properties.FileName log field is mapped to the target.file.names UDM field.
properties.SHA1 target.file.sha1 If the properties.ActionType log field contains one of the following values:
  • AmsiScriptDetection
  • AppGuardCreateContainer
  • AppGuardLaunchedWithUrl
  • AppGuardResumeContainer
  • AppGuardStopContainer
  • AppGuardSuspendContainer
  • ClrUnbackedModuleLoaded
  • CreateRemoteThreadApiCall
  • DpapiAccessed
  • DriverLoad
  • GetAsyncKeyStateApiCall
  • GetClipboardData
  • MemoryRemoteProtect
  • NamedPipeEvent
  • NtAllocateVirtualMemoryApiCall
  • NtAllocateVirtualMemoryRemoteApiCall
  • NtMapViewOfSectionRemoteApiCall
  • NtProtectVirtualMemoryApiCall
  • OpenProcessApiCall
  • PowerShellCommand
  • ProcessCreatedUsingWmiQuery
  • ProcessPrimaryTokenModified
  • PTraceDetected
  • QueueUserApcRemoteApiCall
  • ReadProcessMemoryApiCall
  • RemoteWmiOperation
  • RemovableStoragePolicyTriggered
  • ScriptContent
  • SetThreadContextRemoteApiCall
  • WmiBindEventFilterToConsumer
  • WriteProcessMemoryApiCall
  • WriteToLsassProcessMemory
  • AsrAdobeReaderChildProcessAudited
  • AsrAdobeReaderChildProcessBlocked
  • AsrAdobeReaderChildProcessWarnBypassed
  • AsrOfficeChildProcessAudited
  • AsrOfficeChildProcessBlocked
  • AsrOfficeChildProcessWarnBypassed
  • AsrOfficeCommAppChildProcessAudited
  • AsrOfficeCommAppChildProcessBlocked
  • AsrOfficeCommAppChildProcessWarnBypassed
  • AsrOfficeProcessInjectionAudited
  • AsrOfficeProcessInjectionBlocked
  • AsrOfficeProcessInjectionWarnBypassed
  • AsrPsexecWmiChildProcessAudited
  • AsrPsexecWmiChildProcessBlocked
  • AsrPsexecWmiChildProcessWarnBypassed
  • AsrUntrustedUsbProcessAudited
  • AsrUntrustedUsbProcessBlocked
  • AsrUntrustedUsbProcessWarnBypassed
  • ExploitGuardChildProcessAudited
  • ExploitGuardChildProcessBlocked
and if the properties.SHA1 log field value matches the regular expression pattern ^[0-9a-f]+$, then properties.SHA1 log field is mapped to the target.process.file.sha1 UDM field.
Otherwise, if the properties.SHA1 log field value matches the regular expression pattern ^[0-9a-f]+$, then properties.SHA1 log field is mapped to the target.file.sha1 UDM field.
properties.SHA1 target.process.file.sha1 If the properties.ActionType log field contains one of the following values:
  • AmsiScriptDetection
  • AppGuardCreateContainer
  • AppGuardLaunchedWithUrl
  • AppGuardResumeContainer
  • AppGuardStopContainer
  • AppGuardSuspendContainer
  • ClrUnbackedModuleLoaded
  • CreateRemoteThreadApiCall
  • DpapiAccessed
  • DriverLoad
  • GetAsyncKeyStateApiCall
  • GetClipboardData
  • MemoryRemoteProtect
  • NamedPipeEvent
  • NtAllocateVirtualMemoryApiCall
  • NtAllocateVirtualMemoryRemoteApiCall
  • NtMapViewOfSectionRemoteApiCall
  • NtProtectVirtualMemoryApiCall
  • OpenProcessApiCall
  • PowerShellCommand
  • ProcessCreatedUsingWmiQuery
  • ProcessPrimaryTokenModified
  • PTraceDetected
  • QueueUserApcRemoteApiCall
  • ReadProcessMemoryApiCall
  • RemoteWmiOperation
  • RemovableStoragePolicyTriggered
  • ScriptContent
  • SetThreadContextRemoteApiCall
  • WmiBindEventFilterToConsumer
  • WriteProcessMemoryApiCall
  • WriteToLsassProcessMemory
  • AsrAdobeReaderChildProcessAudited
  • AsrAdobeReaderChildProcessBlocked
  • AsrAdobeReaderChildProcessWarnBypassed
  • AsrOfficeChildProcessAudited
  • AsrOfficeChildProcessBlocked
  • AsrOfficeChildProcessWarnBypassed
  • AsrOfficeCommAppChildProcessAudited
  • AsrOfficeCommAppChildProcessBlocked
  • AsrOfficeCommAppChildProcessWarnBypassed
  • AsrOfficeProcessInjectionAudited
  • AsrOfficeProcessInjectionBlocked
  • AsrOfficeProcessInjectionWarnBypassed
  • AsrPsexecWmiChildProcessAudited
  • AsrPsexecWmiChildProcessBlocked
  • AsrPsexecWmiChildProcessWarnBypassed
  • AsrUntrustedUsbProcessAudited
  • AsrUntrustedUsbProcessBlocked
  • AsrUntrustedUsbProcessWarnBypassed
  • ExploitGuardChildProcessAudited
  • ExploitGuardChildProcessBlocked
and if the properties.SHA1 log field value matches the regular expression pattern ^[0-9a-f]+$, then properties.SHA1 log field is mapped to the target.process.file.sha1 UDM field.
Otherwise, if the properties.SHA1 log field value matches the regular expression pattern ^[0-9a-f]+$, then properties.SHA1 log field is mapped to the target.file.sha1 UDM field.
properties.SHA256 target.file.sha256 If the properties.ActionType log field contains one of the following values:
  • AmsiScriptDetection
  • AppGuardCreateContainer
  • AppGuardLaunchedWithUrl
  • AppGuardResumeContainer
  • AppGuardStopContainer
  • AppGuardSuspendContainer
  • ClrUnbackedModuleLoaded
  • CreateRemoteThreadApiCall
  • DpapiAccessed
  • DriverLoad
  • GetAsyncKeyStateApiCall
  • GetClipboardData
  • MemoryRemoteProtect
  • NamedPipeEvent
  • NtAllocateVirtualMemoryApiCall
  • NtAllocateVirtualMemoryRemoteApiCall
  • NtMapViewOfSectionRemoteApiCall
  • NtProtectVirtualMemoryApiCall
  • OpenProcessApiCall
  • PowerShellCommand
  • ProcessCreatedUsingWmiQuery
  • ProcessPrimaryTokenModified
  • PTraceDetected
  • QueueUserApcRemoteApiCall
  • ReadProcessMemoryApiCall
  • RemoteWmiOperation
  • RemovableStoragePolicyTriggered
  • ScriptContent
  • SetThreadContextRemoteApiCall
  • WmiBindEventFilterToConsumer
  • WriteProcessMemoryApiCall
  • WriteToLsassProcessMemory
  • AsrAdobeReaderChildProcessAudited
  • AsrAdobeReaderChildProcessBlocked
  • AsrAdobeReaderChildProcessWarnBypassed
  • AsrOfficeChildProcessAudited
  • AsrOfficeChildProcessBlocked
  • AsrOfficeChildProcessWarnBypassed
  • AsrOfficeCommAppChildProcessAudited
  • AsrOfficeCommAppChildProcessBlocked
  • AsrOfficeCommAppChildProcessWarnBypassed
  • AsrOfficeProcessInjectionAudited
  • AsrOfficeProcessInjectionBlocked
  • AsrOfficeProcessInjectionWarnBypassed
  • AsrPsexecWmiChildProcessAudited
  • AsrPsexecWmiChildProcessBlocked
  • AsrPsexecWmiChildProcessWarnBypassed
  • AsrUntrustedUsbProcessAudited
  • AsrUntrustedUsbProcessBlocked
  • AsrUntrustedUsbProcessWarnBypassed
  • ExploitGuardChildProcessAudited
  • ExploitGuardChildProcessBlocked
and if the properties.SHA256 log field value matches the regular expression pattern ^[a-f0-9]{64}$, then properties.SHA256 log field is mapped to the target.process.file.sha256 UDM field.
Otherwise, if the properties.SHA256 log field value matches the regular expression pattern ^[a-f0-9]{64}$, then properties.SHA256 log field is mapped to the target.file.sha256 UDM field.
properties.SHA256 target.process.file.sha256 If the properties.ActionType log field contains one of the following values:
  • AmsiScriptDetection
  • AppGuardCreateContainer
  • AppGuardLaunchedWithUrl
  • AppGuardResumeContainer
  • AppGuardStopContainer
  • AppGuardSuspendContainer
  • ClrUnbackedModuleLoaded
  • CreateRemoteThreadApiCall
  • DpapiAccessed
  • DriverLoad
  • GetAsyncKeyStateApiCall
  • GetClipboardData
  • MemoryRemoteProtect
  • NamedPipeEvent
  • NtAllocateVirtualMemoryApiCall
  • NtAllocateVirtualMemoryRemoteApiCall
  • NtMapViewOfSectionRemoteApiCall
  • NtProtectVirtualMemoryApiCall
  • OpenProcessApiCall
  • PowerShellCommand
  • ProcessCreatedUsingWmiQuery
  • ProcessPrimaryTokenModified
  • PTraceDetected
  • QueueUserApcRemoteApiCall
  • ReadProcessMemoryApiCall
  • RemoteWmiOperation
  • RemovableStoragePolicyTriggered
  • ScriptContent
  • SetThreadContextRemoteApiCall
  • WmiBindEventFilterToConsumer
  • WriteProcessMemoryApiCall
  • WriteToLsassProcessMemory
  • AsrAdobeReaderChildProcessAudited
  • AsrAdobeReaderChildProcessBlocked
  • AsrAdobeReaderChildProcessWarnBypassed
  • AsrOfficeChildProcessAudited
  • AsrOfficeChildProcessBlocked
  • AsrOfficeChildProcessWarnBypassed
  • AsrOfficeCommAppChildProcessAudited
  • AsrOfficeCommAppChildProcessBlocked
  • AsrOfficeCommAppChildProcessWarnBypassed
  • AsrOfficeProcessInjectionAudited
  • AsrOfficeProcessInjectionBlocked
  • AsrOfficeProcessInjectionWarnBypassed
  • AsrPsexecWmiChildProcessAudited
  • AsrPsexecWmiChildProcessBlocked
  • AsrPsexecWmiChildProcessWarnBypassed
  • AsrUntrustedUsbProcessAudited
  • AsrUntrustedUsbProcessBlocked
  • AsrUntrustedUsbProcessWarnBypassed
  • ExploitGuardChildProcessAudited
  • ExploitGuardChildProcessBlocked
and if the properties.SHA256 log field value matches the regular expression pattern ^[a-f0-9]{64}$, then properties.SHA256 log field is mapped to the target.process.file.sha256 UDM field.
Otherwise, if the properties.SHA256 log field value matches the regular expression pattern ^[a-f0-9]{64}$, then properties.SHA256 log field is mapped to the target.file.sha256 UDM field.
properties.FileSize target.file.size If the properties.ActionType log field contains one of the following values:
  • AmsiScriptDetection
  • AppGuardCreateContainer
  • AppGuardLaunchedWithUrl
  • AppGuardResumeContainer
  • AppGuardStopContainer
  • AppGuardSuspendContainer
  • ClrUnbackedModuleLoaded
  • CreateRemoteThreadApiCall
  • DpapiAccessed
  • DriverLoad
  • GetAsyncKeyStateApiCall
  • GetClipboardData
  • MemoryRemoteProtect
  • NamedPipeEvent
  • NtAllocateVirtualMemoryApiCall
  • NtAllocateVirtualMemoryRemoteApiCall
  • NtMapViewOfSectionRemoteApiCall
  • NtProtectVirtualMemoryApiCall
  • OpenProcessApiCall
  • PowerShellCommand
  • ProcessCreatedUsingWmiQuery
  • ProcessPrimaryTokenModified
  • PTraceDetected
  • QueueUserApcRemoteApiCall
  • ReadProcessMemoryApiCall
  • RemoteWmiOperation
  • RemovableStoragePolicyTriggered
  • ScriptContent
  • SetThreadContextRemoteApiCall
  • WmiBindEventFilterToConsumer
  • WriteProcessMemoryApiCall
  • WriteToLsassProcessMemory
  • AsrAdobeReaderChildProcessAudited
  • AsrAdobeReaderChildProcessBlocked
  • AsrAdobeReaderChildProcessWarnBypassed
  • AsrOfficeChildProcessAudited
  • AsrOfficeChildProcessBlocked
  • AsrOfficeChildProcessWarnBypassed
  • AsrOfficeCommAppChildProcessAudited
  • AsrOfficeCommAppChildProcessBlocked
  • AsrOfficeCommAppChildProcessWarnBypassed
  • AsrOfficeProcessInjectionAudited
  • AsrOfficeProcessInjectionBlocked
  • AsrOfficeProcessInjectionWarnBypassed
  • AsrPsexecWmiChildProcessAudited
  • AsrPsexecWmiChildProcessBlocked
  • AsrPsexecWmiChildProcessWarnBypassed
  • AsrUntrustedUsbProcessAudited
  • AsrUntrustedUsbProcessBlocked
  • AsrUntrustedUsbProcessWarnBypassed
  • ExploitGuardChildProcessAudited
  • ExploitGuardChildProcessBlocked
then properties.FileSize log field is mapped to the target.process.file.size UDM field.
Otherwise, properties.FileSize log field is mapped to the target.file.size UDM field.
properties.FileSize target.process.file.size If the properties.ActionType log field contains one of the following values:
  • AmsiScriptDetection
  • AppGuardCreateContainer
  • AppGuardLaunchedWithUrl
  • AppGuardResumeContainer
  • AppGuardStopContainer
  • AppGuardSuspendContainer
  • ClrUnbackedModuleLoaded
  • CreateRemoteThreadApiCall
  • DpapiAccessed
  • DriverLoad
  • GetAsyncKeyStateApiCall
  • GetClipboardData
  • MemoryRemoteProtect
  • NamedPipeEvent
  • NtAllocateVirtualMemoryApiCall
  • NtAllocateVirtualMemoryRemoteApiCall
  • NtMapViewOfSectionRemoteApiCall
  • NtProtectVirtualMemoryApiCall
  • OpenProcessApiCall
  • PowerShellCommand
  • ProcessCreatedUsingWmiQuery
  • ProcessPrimaryTokenModified
  • PTraceDetected
  • QueueUserApcRemoteApiCall
  • ReadProcessMemoryApiCall
  • RemoteWmiOperation
  • RemovableStoragePolicyTriggered
  • ScriptContent
  • SetThreadContextRemoteApiCall
  • WmiBindEventFilterToConsumer
  • WriteProcessMemoryApiCall
  • WriteToLsassProcessMemory
  • AsrAdobeReaderChildProcessAudited
  • AsrAdobeReaderChildProcessBlocked
  • AsrAdobeReaderChildProcessWarnBypassed
  • AsrOfficeChildProcessAudited
  • AsrOfficeChildProcessBlocked
  • AsrOfficeChildProcessWarnBypassed
  • AsrOfficeCommAppChildProcessAudited
  • AsrOfficeCommAppChildProcessBlocked
  • AsrOfficeCommAppChildProcessWarnBypassed
  • AsrOfficeProcessInjectionAudited
  • AsrOfficeProcessInjectionBlocked
  • AsrOfficeProcessInjectionWarnBypassed
  • AsrPsexecWmiChildProcessAudited
  • AsrPsexecWmiChildProcessBlocked
  • AsrPsexecWmiChildProcessWarnBypassed
  • AsrUntrustedUsbProcessAudited
  • AsrUntrustedUsbProcessBlocked
  • AsrUntrustedUsbProcessWarnBypassed
  • ExploitGuardChildProcessAudited
  • ExploitGuardChildProcessBlocked
then properties.FileSize log field is mapped to the target.process.file.size UDM field.
Otherwise, properties.FileSize log field is mapped to the target.file.size UDM field.
properties.RemoteDeviceName principal.hostname If the properties.ActionType log field contains one of the following values, then the properties.RemoteDeviceName log field is mapped to the principal.hostname and principal.asset.hostname UDM field:
  • RemoteWmiOperation
  • ProcessCreatedUsingWmiQuery
Otherwise, the properties.RemoteDeviceName log field is mapped to the target.hostname and target.asset.hostname UDM fields.
properties.RemoteDeviceName principal.asset.hostname If the properties.ActionType log field contains one of the following values, then the properties.RemoteDeviceName log field is mapped to the principal.hostname and principal.asset.hostname UDM field:
  • RemoteWmiOperation
  • ProcessCreatedUsingWmiQuery
Otherwise, the properties.RemoteDeviceName log field is mapped to the target.hostname and target.asset.hostname UDM fields.
properties.RemoteDeviceName target.hostname If the properties.ActionType log field contains one of the following values, then the properties.RemoteDeviceName log field is mapped to the principal.hostname and principal.asset.hostname UDM field:
  • RemoteWmiOperation
  • ProcessCreatedUsingWmiQuery
Otherwise, the properties.RemoteDeviceName log field is mapped to the target.hostname and target.asset.hostname UDM fields.
properties.RemoteDeviceName target.asset.hostname If the properties.ActionType log field contains one of the following values, then the properties.RemoteDeviceName log field is mapped to the principal.hostname and principal.asset.hostname UDM field:
  • RemoteWmiOperation
  • ProcessCreatedUsingWmiQuery
Otherwise, the properties.RemoteDeviceName log field is mapped to the target.hostname and target.asset.hostname UDM fields.
properties.RemoteIP principal.ip If the properties.ActionType log field contains one of the following values, then the properties.RemoteIP log field is mapped to the principal.ip and principal.asset.ip UDM field:
  • RemoteWmiOperation
  • ProcessCreatedUsingWmiQuery
Otherwise, the properties.RemoteIP log field is mapped to the target.ip and target.asset.ip UDM fields.
properties.RemoteIP principal.asset.ip If the properties.ActionType log field contains one of the following values, then the properties.RemoteIP log field is mapped to the principal.ip and principal.asset.ip UDM field:
  • RemoteWmiOperation
  • ProcessCreatedUsingWmiQuery
Otherwise, the properties.RemoteIP log field is mapped to the target.ip and target.asset.ip UDM fields.
properties.RemoteIP target.ip If the properties.ActionType log field contains one of the following values, then the properties.RemoteIP log field is mapped to the principal.ip and principal.asset.ip UDM field:
  • RemoteWmiOperation
  • ProcessCreatedUsingWmiQuery
Otherwise, the properties.RemoteIP log field is mapped to the target.ip and target.asset.ip UDM fields.
properties.RemoteIP target.asset.ip If the properties.ActionType log field contains one of the following values, then the properties.RemoteIP log field is mapped to the principal.ip and principal.asset.ip UDM field:
  • RemoteWmiOperation
  • ProcessCreatedUsingWmiQuery
Otherwise, the properties.RemoteIP log field is mapped to the target.ip and target.asset.ip UDM fields.
properties.RemotePort principal.port If the properties.ActionType log field contains one of the following values, then the properties.RemotePort log field is mapped to the principal.port UDM field:
  • RemoteWmiOperation
  • ProcessCreatedUsingWmiQuery
Otherwise, the properties.RemotePort log field is mapped to the target.port UDM field.
properties.RemotePort target.port If the properties.ActionType log field contains one of the following values, then the properties.RemotePort log field is mapped to the principal.port UDM field:
  • RemoteWmiOperation
  • ProcessCreatedUsingWmiQuery
Otherwise, the properties.RemotePort log field is mapped to the target.port UDM field.
properties.ProcessCommandLine target.process.command_line
properties.ProcessId target.process.pid
properties.ProcessTokenElevation target.process.token_elevation_type If the properties.ProcessTokenElevation log field value is equal to TokenElevationTypeFull, then the target.process.token_elevation_type UDM field is set to TYPE_1.

Otherwise, if the properties.ProcessTokenElevation log field value is equal to TokenElevationTypeDefault, then the target.process.token_elevation_type UDM field is set to TYPE_2.

Otherwise, if the properties.ProcessTokenElevation log field value is equal to TokenElevationTypeLimited, then the target.process.token_elevation_type UDM field is set to TYPE_3.
properties.RegistryKey target.registry.registry_key
properties.RegistryValueData target.registry.registry_value_data
properties.RegistryValueName target.registry.registry_value_name
properties.RemoteUrl principal.url If the properties.ActionType log field contains one of the following values, then the properties.RemoteUrl log field is mapped to the principal.url UDM field:
  • RemoteWmiOperation
  • ProcessCreatedUsingWmiQuery
Otherwise, the properties.RemoteUrl log field is mapped to the target.url UDM field.
properties.RemoteUrl target.url If the properties.ActionType log field contains one of the following values, then the properties.RemoteUrl log field is mapped to the principal.url UDM field:
  • RemoteWmiOperation
  • ProcessCreatedUsingWmiQuery
Otherwise, the properties.RemoteUrl log field is mapped to the target.url UDM field.
properties.AdditionalFields additional.fields[additional_fields]
properties.AppGuardContainerId additional.fields[app_guard_container_id]
properties.InitiatingProcessCreationTime additional.fields[initiating_process_creation_time]
properties.InitiatingProcessLogonId additional.fields[initiating_process_logon_id]
properties.InitiatingProcessParentCreationTime additional.fields[initiating_process_parent_creation_time]
properties.ProcessCreationTime additional.fields[process_creation_time]
properties.InitiatingProcessVersionInfoCompanyName principal.process.file.exif_info.company
properties.InitiatingProcessVersionInfoFileDescription principal.process.file.exif_info.file_description
properties.InitiatingProcessVersionInfoInternalFileName additional.fields[process_version_info_internal_file_name]
properties.InitiatingProcessVersionInfoOriginalFileName principal.process.file.exif_info.original_file
properties.InitiatingProcessVersionInfoProductName principal.process.file.exif_info.product
properties.InitiatingProcessVersionInfoProductVersion additional.fields[process_version_info_product_version]

字段映射参考信息：MICROSOFT DEFENDER ENDPOINT - AlertEvidence

下表列出了 AlertEvidence 日志类型的日志字段及其对应的 UDM 字段：

Log field UDM mapping Logic
properties.Application principal.application
properties.ResourceType principal.resource.attribute.labels[resource_type]
metadata.event_type The metadata.event_type UDM field is set to SCAN_HOST.
properties.DeviceId
properties.AdditionalFields.MachineId
properties.AdditionalFields.Host.MachineId
properties.AdditionalFields.ImageFile.Host.MachineId
properties.AdditionalFields.ImageFile.Host.HostMachineId
properties.AdditionalFields.Host.HostMachineId
properties.AdditionalFields.Key.Device.MachineId
properties.AdditionalFields.Key.Device.HostMachineId		 principal.asset_id If the properties.DeviceId log field value is not empty then, DeviceID:properties.DeviceId is mapped to the principal.asset_id UDM field.
Otherwise, if the properties.AdditionalFields.MachineId log field value is not empty then, DeviceID:properties.AdditionalFields.MachineId is mapped to the principal.asset_id UDM field.
Otherwise, if the properties.AdditionalFields.Host.MachineId log field value is not empty then, DeviceID:properties.AdditionalFields.Host.MachineId is mapped to the principal.asset_id UDM field.
Otherwise, if the properties.AdditionalFields.ImageFile.Host.MachineId log field value is not empty then, DeviceID:properties.AdditionalFields.ImageFile.Host.MachineId is mapped to the principal.asset_id UDM field.
Otherwise, if the properties.AdditionalFields.ImageFile.Host.HostMachineId log field value is not empty then, DeviceID:properties.AdditionalFields.ImageFile.Host.HostMachineId is mapped to the principal.asset_id UDM field.
Otherwise, if the properties.AdditionalFields.Host.HostMachineId log field value is not empty then, DeviceID:properties.AdditionalFields.Host.HostMachineId is mapped to the principal.asset_id UDM field.
Otherwise, if the properties.AdditionalFields.Key.Device.MachineId log field value is not empty then, DeviceID:properties.AdditionalFields.Key.Device.MachineId is mapped to the principal.asset_id UDM field.
Otherwise, if the properties.AdditionalFields.Key.Device.HostMachineId log field value is not empty then, DeviceID:properties.AdditionalFields.Key.Device.HostMachineId is mapped to the principal.asset_id UDM field.
properties.DeviceId
properties.AdditionalFields.MachineId
properties.AdditionalFields.Host.MachineId
properties.AdditionalFields.ImageFile.Host.MachineId
properties.AdditionalFields.ImageFile.Host.HostMachineId
properties.AdditionalFields.Host.HostMachineId
properties.AdditionalFields.Key.Device.MachineId
properties.AdditionalFields.Key.Device.HostMachineId		 principal.asset.asset_id If the properties.DeviceId log field value is not empty then, DeviceID:properties.DeviceId is mapped to the principal.asset.asset_id UDM field.
Otherwise, if the properties.AdditionalFields.MachineId log field value is not empty then, DeviceID:properties.AdditionalFields.MachineId is mapped to the principal.asset.asset_id UDM field.
Otherwise, if the properties.AdditionalFields.Host.MachineId log field value is not empty then, DeviceID:properties.AdditionalFields.Host.MachineId is mapped to the principal.asset.asset_id UDM field.
Otherwise, if the properties.AdditionalFields.ImageFile.Host.MachineId log field value is not empty then, DeviceID:properties.AdditionalFields.ImageFile.Host.MachineId is mapped to the principal.asset.asset_id UDM field.
Otherwise, if the properties.AdditionalFields.ImageFile.Host.HostMachineId log field value is not empty then, DeviceID:properties.AdditionalFields.ImageFile.Host.HostMachineId is mapped to the principal.asset.asset_id UDM field.
Otherwise, if the properties.AdditionalFields.Host.HostMachineId log field value is not empty then, DeviceID:properties.AdditionalFields.Host.HostMachineId is mapped to the principal.asset.asset_id UDM field.
Otherwise, if the properties.AdditionalFields.Key.Device.MachineId log field value is not empty then, DeviceID:properties.AdditionalFields.Key.Device.MachineId is mapped to the principal.asset.asset_id UDM field.
Otherwise, if the properties.AdditionalFields.Key.Device.HostMachineId log field value is not empty then, DeviceID:properties.AdditionalFields.Key.Device.HostMachineId is mapped to the principal.asset.asset_id UDM field.
properties.DeviceName
properties.AdditionalFields.HostName
properties.AdditionalFields.Host.HostName
properties.AdditionalFields.ImageFile.Host.HostName
properties.AdditionalFields.Key.Device.HostName		 principal.hostname If the properties.DeviceName log field value is not empty then, properties.DeviceName log field is mapped to the principal.hostname UDM field.
Otherwise, if the properties.AdditionalFields.HostName log field value is not empty then, properties.AdditionalFields.HostName log field is mapped to the principal.hostname UDM field.
Otherwise, if the properties.AdditionalFields.ImageFile.Host.HostName log field value is not empty then, properties.AdditionalFields.ImageFile.Host.HostName log field is mapped to the principal.hostname UDM field.
Otherwise, if the properties.AdditionalFields.Host.HostName log field value is not empty then, properties.AdditionalFields.Host.HostName log field is mapped to the principal.hostname UDM field.
Otherwise, if the properties.AdditionalFields.Key.Device.HostName log field value is not empty then, properties.AdditionalFields.Key.Device.HostName log field is mapped to the principal.hostname UDM field.
properties.DeviceName
properties.AdditionalFields.HostName
properties.AdditionalFields.Host.HostName
properties.AdditionalFields.ImageFile.Host.HostName
properties.AdditionalFields.Key.Device.HostName		 principal.asset.hostname If the properties.DeviceName log field value is not empty then, properties.DeviceName log field is mapped to the principal.asset.hostname UDM field.
Otherwise, if the properties.AdditionalFields.HostName log field value is not empty then, properties.AdditionalFields.HostName log field is mapped to the principal.asset.hostname UDM field.
Otherwise, if the properties.AdditionalFields.ImageFile.Host.HostName log field value is not empty then, properties.AdditionalFields.ImageFile.Host.HostName log field is mapped to the principal.asset.hostname UDM field.
Otherwise, if the properties.AdditionalFields.Host.HostName log field value is not empty then, properties.AdditionalFields.Host.HostName log field is mapped to the principal.asset.hostname UDM field.
Otherwise, if the properties.AdditionalFields.Key.Device.HostName log field value is not empty then, properties.AdditionalFields.Key.Device.HostName log field is mapped to the principal.asset.hostname UDM field.
properties.LocalIP principal.asset.ip If the properties.LocalIP log field value is not empty, then the properties.LocalIP log field is mapped to the principal.asset.ip UDM field.
properties.FolderPath target.file.full_path If the properties.FileName log field value matches the regular expression pattern the properties.FolderPath, then the properties.FolderPath log field is mapped to the target.file.full_path UDM field.

Otherwise, the properties.FolderPath/properties.FileName log field is mapped to the target.file.full_path UDM field.
properties.FileName target.file.names
properties.SHA1 target.file.sha1 If the properties.SHA1 log field value matches the regular expression pattern ^the 0-9a-f log field value+$, then the properties.SHA1 log field is mapped to the target.file.sha1 UDM field.
properties.SHA256 target.file.sha256 If the properties.SHA256 log field value matches the regular expression pattern ^the a-f0-9, then 64$, then the properties.SHA256 log field is mapped to the target.file.sha256 UDM field.
properties.FileSize target.file.size
properties.AccountDomain principal.administrative_domain
properties.RemoteIP target.ip
properties.AdditionalFields additional.fields[additionalfields]
properties.ProcessCommandLine target.process.command_line
properties.RegistryKey target.registry.registry_key
properties.RegistryValueData target.registry.registry_value_data
properties.RegistryValueName target.registry.registry_value_name
properties.CloudPlatform principal.resource.attribute.cloud.environment If the properties.CloudPlatform log field value matches the regular expression pattern /(?i)Amazon Web Services/, then the principal.resource.attribute.cloud.environment UDM field is set to AMAZON_WEB_SERVICES.

Otherwise, if the properties.CloudPlatform log field value matches the regular expression pattern /(?i)Google Cloud Platform/, then the principal.resource.attribute.cloud.environment UDM field is set to GOOGLE_CLOUD_PLATFORM.

Otherwise, if the properties.CloudPlatform log field value matches one of the regular expression patterns /(?i)Azure/ or /(?i)Azure Arc/, then the principal.resource.attribute.cloud.environment UDM field is set to MICROSOFT_AZURE.

Otherwise, the principal.resource.attribute.cloud.environment UDM field is set to UNSPECIFIED_CLOUD_ENVIRONMENT.
properties.SubscriptionId principal.resource.attribute.labels[subscription_id]
properties.CloudResource principal.resource.name
properties.ResourceID principal.resource.product_object_id
principal.resource.resource_type The principal.resource.resource_type UDM field is set to CLOUD_PROJECT.
properties.Categories security_result.category_details
properties.Severity security_result.severity
properties.Title security_result.threat_name
properties.ThreatFamily security_result.detection_fields[threat_family]
properties.RemoteUrl target.url
properties.EvidenceDirection additional.fields[evidence_direction]
properties.EvidenceRole additional.fields[evidence_role]
properties.AccountObjectId additional.fields[account_object_id]
properties.AccountUpn principal.user.user_display_name
properties.AccountName principal.user.userid
properties.AccountSid principal.user.windows_sid
properties.Timestamp metadata.event_timestamp
properties.EntityType principal.resource.resource_subtype
properties.AlertId metadata.product_log_id
properties.DetectionSource security_result.about.resource.attribute.labels[detection_source]
properties.ServiceSource security_result.about.resource.attribute.labels[service_source]
properties.AttackTechniques security_result.attack_details.techniques.name
properties.ApplicationId additional.fields[application_id]
properties.EmailSubject network.email.subject
properties.NetworkMessageId network.email.mail_id
properties.OAuthApplicationId additional.fields[oauth_application_id]

字段映射参考信息：MICROSOFT DEFENDER ENDPOINT - AlertInfo

下表列出了 AlertInfo 日志类型的日志字段及其对应的 UDM 字段：

Log field UDM mapping Logic
properties.Timestamp metadata.event_timestamp
metadata.event_type The metadata.event_type UDM field is set to GENERIC_EVENT.
properties.AlertId security_result.threat_id
properties.AttackTechniques security_result.attack_details.techniques.name
properties.DetectionSource security_result.detection_fields[detection_source]
properties.ServiceSource principal.application
properties.Severity security_result.severity If the properties.Severity log field value matches the regular expression pattern (?i)(informational), then the security_result.severity UDM field is set to INFORMATIONAL.

Otherwise, if the properties.Severity log field value matches the regular expression pattern (?i)(low), then the security_result.severity UDM field is set to LOW.

Otherwise, if the properties.Severity log field value matches the regular expression pattern (?i)(medium), then the security_result.severity UDM field is set to MEDIUM.

Otherwise, if the properties.Severity log field value matches the regular expression pattern (?i)(high), then the security_result.severity UDM field is set to HIGH.
properties.Category security_result.category_details
properties.Title security_result.threat_name
properties.Title security_result.rule_name

字段映射参考信息：MICROSOFT DEFENDER ENDPOINT - DeviceAlertEvents

下表列出了 DeviceAlertEvents 日志类型的日志字段及其对应的 UDM 字段：

Log field UDM mapping Logic
properties.Timestamp metadata.event_timestamp
metadata.event_type The metadata.event_type UDM field is set to SCAN_HOST.
properties.ReportId security_result.detection_fields[report_id]
properties.DeviceId principal.asset_id The principal.asset_id is set to DeviceID:%{properties.DeviceId}.
properties.MachineGroup principal.group.group_display_name
properties.DeviceName principal.hostname
properties.AttackTechniques security_result.attack_details.techniques.name
properties.Category security_result.category_details
properties.AlertId metadata.product_log_id
properties.MitreTechniques security_result.detection_fields[mitre_techniques]
properties.Severity security_result.severity If the properties.Severity log field value is equal to High, then the security_result.severity UDM field is set to HIGH.

Otherwise, if the properties.Severity log field value is equal to Medium, then the security_result.severity UDM field is set to MEDIUM.

Otherwise, if the properties.Severity log field value is equal to Low, then the security_result.severity UDM field is set to LOW.

Otherwise, if the properties.Severity log field value is equal to Informational, then the security_result.severity UDM field is set to INFORMATIONAL.
properties.Title security_result.threat_name
properties.Title security_result.rule_name
properties.RemoteIp target.ip
properties.FileName target.file.names
properties.SHA1 target.file.sha1 If the properties.SHA1 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.SHA1 log field is mapped to the target.file.sha1 UDM field.
properties.RemoteUrl target.url
properties.Table additional.fields[table]

字段映射参考信息：MICROSOFT DEFENDER ENDPOINT - DeviceFileCertificateInfo

下表列出了 DeviceFileCertificateInfo 日志类型的日志字段及其对应的 UDM 字段：

Log field UDM mapping Logic
properties.Timestamp metadata.creation_timestamp
metadata.entity_type The metadata.entity_type UDM field is set to FILE.
properties.ReportId metadata.product_entity_id
properties.DeviceId entity.asset_id The entity.asset_id is set to DeviceID:%{properties.DeviceId}.
properties.SHA1 entity.file.sha1 If the properties.SHA1 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.SHA1 log field is mapped to the entity.file.sha1 UDM field.
properties.Issuer entity.file.signature_info.sigcheck.signers.cert_issuer
properties.Signer entity.file.signature_info.sigcheck.signers.name
properties.IsSigned entity.file.signature_info.sigcheck.verified If the properties.IsSigned log field value is equal to true, then the entity.file.signature_info.sigcheck.verified UDM field is set to TRUE.

Otherwise, the entity.file.signature_info.sigcheck.verified UDM field is set to FALSE.
properties.DeviceName entity.asset.hostname
properties.CertificateCountersignatureTime additional.fields[certificate_countersignature_time]
properties.CertificateSerialNumber entity.file.signature_info.sigcheck.x509.serial_number
properties.CertificateCreationTime additional.fields[certification_creation_time]
properties.CertificateExpirationTime additional.fields[certification_expiration_time]
properties.CrlDistributionPointUrls additional.fields[crl_distribution_point_urls]
properties.IsRootSignerMicrosoft additional.fields[is_root_signer_microsoft]
properties.IsTrusted additional.fields[is_trusted]
properties.IssuerHash additional.fields[issuer_hash]
properties.SignatureType additional.fields[signature_type]
properties.SignerHash additional.fields[signer_hash]

字段映射参考信息：MICROSOFT DEFENDER ENDPOINT - DeviceImageLoadEvents

下表列出了 DeviceImageLoadEvents 日志类型的日志字段及其对应的 UDM 字段：

Log field UDM mapping Logic
properties.InitiatingProcessSessionId additional.fields[initiating_process_session_id]
properties.IsInitiatingProcessRemoteSession additional.fields[is_initiating_process_remote_session]
properties.InitiatingProcessRemoteSessionDeviceName src.hostname
properties.InitiatingProcessRemoteSessionIP src.ip
properties.Timestamp metadata.event_timestamp
metadata.event_type The metadata.event_type UDM field is set to PROCESS_MODULE_LOAD.
properties.ReportId metadata.product_log_id
properties.InitiatingProcessAccountDomain principal.administrative_domain
principal.DeviceId principal.asset_id The principal.asset_id is set to DeviceID:%{principal.DeviceId}.
properties.DeviceName principal.hostname
properties.InitiatingProcessCommandLine principal.process.command_line
properties.InitiatingProcessFolderPath principal.process.file.full_path If the properties.InitiatingProcessFolderPath log field value matches the regular expression pattern the properties.InitiatingProcessFileName log field value, then the properties.InitiatingProcessFolderPath log field is mapped to the principal.process.file.full_path UDM field.

Otherwise, the principal.process.file.full_path is set to %{properties.InitiatingProcessFolderPath}/%{properties.InitiatingProcessFileName}.
properties.InitiatingProcessMD5 principal.process.file.md5 If the properties.InitiatingProcessMD5 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.InitiatingProcessMD5 log field is mapped to the principal.process.file.md5 UDM field.
properties.InitiatingProcessFileName principal.process.file.names
properties.InitiatingProcessSHA1 principal.process.file.sha1 If the properties.InitiatingProcessSHA1 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.InitiatingProcessSHA1 log field is mapped to the principal.process.file.sha1 UDM field.
properties.InitiatingProcessSHA256 principal.process.file.sha256 If the properties.InitiatingProcessSHA256 log field value matches the regular expression pattern ^[a-f0-9]{64}$, then the properties.InitiatingProcessSHA256 log field is mapped to the principal.process.file.sha256 UDM field.
properties.InitiatingProcessFileSize principal.process.file.size
properties.InitiatingProcessParentFileName principal.process.parent_process.file.names
properties.InitiatingProcessParentId principal.process.parent_process.pid
properties.InitiatingProcessId principal.process.pid
properties.InitiatingProcessTokenElevation principal.process.token_elevation_type If the properties.InitiatingProcessTokenElevation log field value is equal to TokenElevationTypeFull, then the principal.process.token_elevation_type UDM field is set to TYPE_1.

Otherwise, if the properties.InitiatingProcessTokenElevation log field value is equal to TokenElevationTypeDefault, then the principal.process.token_elevation_type UDM field is set to TYPE_2.

Otherwise, if the properties.InitiatingProcessTokenElevation log field value is equal to TokenElevationTypeLimited, then the principal.process.token_elevation_type UDM field is set to TYPE_3.
properties.InitiatingProcessAccountObjectId principal.user.product_object_id
properties.InitiatingProcessAccountUpn principal.user.user_display_name
properties.InitiatingProcessAccountName principal.user.userid
properties.InitiatingProcessAccountSid principal.user.windows_sid
properties.FolderPath target.process.file.full_path If the properties.FolderPath log field value matches the regular expression pattern the properties.FileName, then the properties.FolderPath log field is mapped to the target.process.file.full_path UDM field.

Otherwise, the target.process.file.full_pathis set to %{properties.FolderPath}/%{properties.FileName}.
properties.MD5 target.process.file.md5 If the properties.MD5 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.MD5 log field is mapped to the target.process.file.md5 UDM field.
properties.FileName target.process.file.names
properties.SHA1 target.process.file.sha1 If the properties.SHA1 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.SHA1 log field is mapped to the target.process.file.sha1 UDM field.
properties.SHA256 target.process.file.sha256 If the properties.SHA256 log field value matches the regular expression pattern ^[a-f0-9]{64}$, then the properties.SHA256 log field is mapped to the target.process.file.sha256 UDM field.
properties.FileSize target.process.file.size
properties.FolderPath target.file.full_path If the properties.FolderPath log field value matches the regular expression pattern the properties.FileName, then the properties.FolderPath log field is mapped to the target.file.full_path UDM field.

Otherwise, the target.file.full_pathis set to %{properties.FolderPath}/%{properties.FileName}.
properties.MD5 target.file.md5 If the properties.MD5 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.MD5 log field is mapped to the target.process.file.md5 UDM field.
properties.FileName target.file.names
properties.SHA1 target.file.sha1 If the properties.SHA1 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.SHA1 log field is mapped to the target.file.sha1 UDM field.
properties.SHA256 target.file.sha256 If the properties.SHA256 log field value matches the regular expression pattern ^[a-f0-9]{64}$, then the properties.SHA256 log field is mapped to the target.file.sha256 UDM field.
properties.FileSize target.file.size
properties.AppGuardContainerId additional.fields[app_guard_container_id]
properties.InitiatingProcessCreationTime additional.fields[initiating_process_creation_time]
properties.InitiatingProcessIntegrityLevel additional.fields[initiating_process_integrity_level]
properties.InitiatingProcessParentCreationTime additional.fields[initiating_process_parent_creation_time]
properties.InitiatingProcessVersionInfoCompanyName principal.process.file.exif_info.company
properties.InitiatingProcessVersionInfoFileDescription principal.process.file.exif_info.file_description
properties.InitiatingProcessVersionInfoInternalFileName additional.fields[initiating_process_version_info_internal_file_name]
properties.InitiatingProcessVersionInfoOriginalFileName principal.process.file.exif_info.original_file
properties.InitiatingProcessVersionInfoProductName principal.process.file.exif_info.product
properties.InitiatingProcessVersionInfoProductVersion additional.fields[initiating_process_version_info_product_version]

字段映射参考信息：MICROSOFT DEFENDER ENDPOINT - DeviceFileEvents

下表列出了 DeviceFileEvents 日志类型的日志字段及其对应的 UDM 字段：

Log field UDM mapping Logic
properties.InitiatingProcessSessionId additional.fields[initiating_process_session_id]
properties.IsInitiatingProcessRemoteSession additional.fields[is_initiating_process_remote_session]
properties.InitiatingProcessRemoteSessionDeviceName additional.fields[initiating_process_remote_session_device_name]
properties.InitiatingProcessRemoteSessionIP additional.fields[initiating_process_remote_session_ip]
properties.Timestamp metadata.event_timestamp
properties.ActionType metadata.event_type If the properties.ActionType log field value is equal to FileCreated, then the metadata.event_type UDM field is set to FILE_CREATION.

Otherwise, if the properties.ActionType log field value is equal to FileDeleted, then the metadata.event_type UDM field is set to FILE_DELETION.

Otherwise, if the properties.ActionType log field value is equal to FileModified, then the metadata.event_type UDM field is set to FILE_MODIFICATION.

Otherwise, if the properties.ActionType log field value is equal to FileRenamed, then the metadata.event_type UDM field is set to FILE_MOVE.
properties.ReportId metadata.product_log_id
properties.RequestProtocol network.application_protocol If the properties.RequestProtocol log field value is equal to SMB, then the network.application_protocol UDM field is set to SMB.

Otherwise, if the properties.RequestProtocol log field value is equal to NFS, then the network.application_protocol UDM field is set to NFS.

Otherwise, if the properties.RequestProtocol log field value is equal to Local, then the network.application_protocol UDM field is set to UNKNOWN_APPLICATION_PROTOCOL.
properties.FileOriginReferrerUrl network.http.referral_url
properties.InitiatingProcessAccountDomain principal.administrative_domain If the properties.InitiatingProcessAccountDomain log field value is not empty, then the properties.InitiatingProcessAccountDomain log field is mapped to the principal.administrative_domain UDM field.
properties.RequestAccountDomain principal.administrative_domain If the properties.InitiatingProcessAccountDomain log field value is empty, then the properties.RequestAccountDomain log field is mapped to the principal.administrative_domain UDM field.
properties.DeviceId principal.asset_id The principal.asset_id is set to DeviceID:%{properties.DeviceId}.
properties.DeviceName principal.hostname
properties.FileOriginIP src.ip
properties.RequestSourceIP src.ip
properties.RequestSourcePort src.port
properties.InitiatingProcessCommandLine principal.process.command_line
properties.InitiatingProcessFolderPath principal.process.file.full_path If the properties.InitiatingProcessFolderPath log field value matches the regular expression pattern the properties.InitiatingProcessFileName log field value, then the properties.InitiatingProcessFolderPath log field is mapped to the principal.process.file.full_path UDM field.

Otherwise, the principal.process.file.full_path is set to %{properties.InitiatingProcessFolderPath}/%{properties.InitiatingProcessFileName}.
properties.InitiatingProcessMD5 principal.process.file.md5 If the properties.InitiatingProcessMD5 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.InitiatingProcessMD5 log field is mapped to the principal.process.file.md5 UDM field.
properties.InitiatingProcessFileName principal.process.file.names
properties.InitiatingProcessSHA1 principal.process.file.sha1 If the properties.InitiatingProcessSHA1 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.InitiatingProcessSHA1 log field is mapped to the principal.process.file.sha1 UDM field.
properties.InitiatingProcessSHA256 principal.process.file.sha256 If the properties.InitiatingProcessSHA256 log field value matches the regular expression pattern ^[a-f0-9]{64}$, then the properties.InitiatingProcessSHA256 log field is mapped to the principal.process.file.sha256 UDM field.
properties.InitiatingProcessFileSize principal.process.file.size
properties.InitiatingProcessParentId principal.process.parent_process.pid
properties.InitiatingProcessParentFileName principal.process.parent_process.file.names
properties.InitiatingProcessId principal.process.pid
properties.InitiatingProcessTokenElevation principal.process.token_elevation_type If the properties.InitiatingProcessTokenElevation log field value is equal to TokenElevationTypeFull, then the principal.process.token_elevation_type UDM field is set to TYPE_1.

Otherwise, if the properties.InitiatingProcessTokenElevation log field value is equal to TokenElevationTypeDefault, then the principal.process.token_elevation_type UDM field is set to TYPE_2.

Otherwise, if the properties.InitiatingProcessTokenElevation log field value is equal to TokenElevationTypeLimited, then the principal.process.token_elevation_type UDM field is set to TYPE_3.
properties.FileOriginUrl src.url
properties.InitiatingProcessAccountObjectId principal.user.product_object_id
properties.InitiatingProcessAccountUpn principal.user.user_display_name
properties.InitiatingProcessAccountName principal.user.userid If the properties.InitiatingProcessAccountName log field value is not empty, then the properties.InitiatingProcessAccountName log field is mapped to the principal.user.userid UDM field.
properties.RequestAccountName principal.user.userid If the properties.InitiatingProcessAccountName log field value is empty, then the properties.RequestAccountName log field is mapped to the principal.user.userid UDM field.
properties.InitiatingProcessAccountSid principal.user.windows_sid If the properties.InitiatingProcessAccountSid log field value is not empty, then the properties.InitiatingProcessAccountSid log field is mapped to the principal.user.windows_sid UDM field.
properties.RequestAccountSid principal.user.windows_sid If the properties.InitiatingProcessAccountSid log field value is empty, then the properties.RequestAccountSid log field is mapped to the principal.user.windows_sid UDM field.
properties.PreviousFolderPath src.file.full_path If the properties.PreviousFolderPath log field value matches the regular expression pattern the properties.PreviousFileName log field value, then the properties.PreviousFolderPath log field is mapped to the src.file.full_path UDM field.

Otherwise, src.file.full_path set to the %{properties.PreviousFolderPath}/%{properties.PreviousFileName}.
properties.PreviousFileName src.file.names
properties.FolderPath target.file.full_path If the properties.FolderPath log field value matches the regular expression pattern the properties.FileName log field value, then the properties.FolderPath log field is mapped to the target.file.full_path UDM field.

Otherwise, the target.file.full_path set to %{properties.FolderPath}/%{properties.FileName}.
properties.MD5 target.file.md5 If the properties.MD5 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.MD5 log field is mapped to the target.file.md5 UDM field.
properties.FileName target.file.names
properties.SHA1 target.file.sha1 If the properties.SHA1 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.SHA1 log field is mapped to the target.file.sha1 UDM field.
properties.SHA256 target.file.sha256 If the properties.SHA256 log field value matches the regular expression pattern ^[a-f0-9]{64}$, then the properties.SHA256 log field is mapped to the target.file.sha256 UDM field.
properties.FileSize target.file.size
properties.SensitivityLabel target.file.tags
properties.SensitivitySubLabel target.file.tags
properties.AdditionalFields additional.fields[additional_fields]
properties.AppGuardContainerId additional.fields[app_guard_container_id]
properties.InitiatingProcessCreationTime additional.fields[initiating_process_creation_time]
properties.InitiatingProcessIntegrityLevel additional.fields[initiating_process_integrity_level]
properties.InitiatingProcessVersionInfoCompanyName principal.process.file.exif_info.company
properties.InitiatingProcessVersionInfoFileDescription principal.process.file.exif_info.file_description
properties.InitiatingProcessVersionInfoInternalFileName additional.fields[initiating_process_version_info_internal_file_name]
properties.InitiatingProcessVersionInfoOriginalFileName principal.process.file.exif_info.original_file
properties.InitiatingProcessVersionInfoProductName principal.process.file.exif_info.product
properties.InitiatingProcessVersionInfoProductVersion additional.fields[initiating_process_version_info_product_version]
properties.InitiatingProcessParentCreationTime additional.fields[initiating_process_parent_creation_time]
properties.IsAzureInfoProtectionApplied additional.fields[is_azure_info_protection_applied]
properties.ShareName additional.fields[share_name]

字段映射参考信息：MICROSOFT DEFENDER ENDPOINT - DeviceInfo

下表列出了 DeviceInfo 日志类型的日志字段及其对应的 UDM 字段：

Log field UDM mapping Logic
properties.AzureResourceId entity.asset.attribute.labels[azure_resource_id]
properties.AwsResourceName entity.asset.attribute.labels[aws_resource_name]
properties.GcpFullResourceName entity.asset.attribute.labels[gcp_full_resource_name]
properties.HardwareUuid entity.asset.hardware.serial_number
properties.AzureVmId entity.asset.attribute.labels[azure_vm_id]
properties.AzureVmSubscriptionId entity.asset.attribute.labels[azure_vm_subscription_id]
properties.IsTransient entity.asset.attribute.labels[is_transient]
properties.OsBuildRevision entity.asset.attribute.labels[os_build_revision]
properties.MitigationStatus entity.asset.attribute.labels[mitigation_status]
properties.Site entity.asset.location.name
properties.DiscoverySources entity.asset.attribute.labels[discovery_sources]
properties.CloudPlatforms entity.asset.attribute.cloud.environment If the properties.CloudPlatforms log field value matches the regular expression pattern /(?i)Amazon Web Services/, then the entity.asset.attribute.cloud.environment UDM field is set to AMAZON_WEB_SERVICES.

Otherwise, if the properties.CloudPlatforms log field value matches the regular expression pattern /(?i)Google Cloud Platform/, then the entity.asset.attribute.cloud.environment UDM field is set to GOOGLE_CLOUD_PLATFORM.

Otherwise, if the properties.CloudPlatforms log field value matches one of the regular expression patterns /(?i)Azure/ or /(?i)Azure Arc/, then the entity.asset.attribute.cloud.environment UDM field is set to MICROSOFT_AZURE.
properties.DeviceId entity.asset_id The entity.asset_id is set to DeviceID:%{properties.DeviceId}.
properties.DeviceId entity.asset.asset_id The entity.asset.asset_id is set to DeviceID:%{properties.DeviceId}.
properties.AadDeviceId entity.asset.attribute.labels[aad_device_id]
properties.AdditionalFields entity.asset.attribute.labels[additional_fields]
properties.ConnectivityType entity.asset.attribute.labels[connectivity_type]
properties.DeviceDynamicTags entity.asset.attribute.labels[device_dynamic_tags]
properties.DeviceManualTags entity.asset.attribute.labels[device_manual_tags]
properties.DeviceSubtype entity.asset.attribute.labels[device_subtype]
properties.HostDeviceId entity.asset.attribute.labels[host_device_id]
properties.IsAzureADJoined entity.asset.attribute.labels[is_azure_ad_joined]
properties.IsInternetFacing entity.asset.attribute.labels[is_internet_facing]
properties.JoinType entity.asset.attribute.labels[join_type]
properties.MergedDeviceIds entity.asset.attribute.labels[merged_device_ids]
properties.MergedToDeviceId entity.asset.attribute.labels[merged_to_device_id]
properties.OnboardingStatus entity.asset.attribute.labels[onboarding_status]
properties.OSArchitecture entity.asset.attribute.labels[os_architecture]
properties.OSDistribution entity.asset.attribute.labels[os_distribution]
properties.OSVersionInfo entity.asset.attribute.labels[os_version_info]
properties.RegistryDeviceTag entity.asset.attribute.labels[registry_divice_tag]
properties.ReportId entity.asset.attribute.labels[report_id]
properties.SensorHealthState entity.asset.attribute.labels[sensor_health_state]
properties.DeviceCategory entity.asset.category
properties.Vendor entity.asset.hardware.manufacturer
properties.Model entity.asset.hardware.model
properties.DeviceName entity.asset.hostname
properties.PublicIP entity.asset.nat_ip
properties.OSBuild entity.asset.platform_software.platform_patch_level
properties.OSPlatform entity.asset.platform_software.platform If the properties.OSPlatform log field value matches the regular expression pattern (?i)macos, then the entity.asset.platform_software.platform UDM field is set to MAC.

Otherwise, if the properties.OSPlatform log field value matches the regular expression pattern (?i)windows, then the entity.asset.platform_software.platform UDM field is set to WINDOWS.

Otherwise, if the properties.OSPlatform log field value matches the regular expression pattern (?i)linux, then the entity.asset.platform_software.platform UDM field is set to LINUX.
properties.OSVersion entity.asset.platform_software.platform_version
properties.ClientVersion entity.asset.software.version
properties.DeviceType entity.asset.type If the properties.DeviceType log field value is equal to NetworkDevice, then the entity.asset.type UDM field is set to NETWORK_ATTACHED_STORAGE.
Otherwise, if the properties.DeviceType log field value is equal to Workstation, then the entity.asset.type UDM field is set to WORKSTATION.
Otherwise, if the properties.DeviceType log field value is equal to Server, then the entity.asset.type UDM field is set to SERVER.
Otherwise, if the properties.DeviceType log field value is equal to Mobile, then the entity.asset.type UDM field is set to MOBILE.
Otherwise, if the properties.DeviceType log field value is equal to Printer, then the entity.asset.type UDM field is set to PRINTER.
Otherwise, the entity.asset.type UDM field is set to ROLE_UNSPECIFIED and properties.DeviceType is mapped to entity.asset.attribute.labels[device_type].
properties.MachineGroup entity.group.group_display_name
properties.ExclusionReason entity.security_result.detection_fields[exclusion_reason]
properties.ExposureLevel entity.security_result.detection_fields[exposure_level]
properties.IsExcluded entity.security_result.detection_fields[is_excluded]
properties.AssetValue entity.security_result.priority If the properties.AssetValue log field value is equal to High, then the entity.security_result.priority UDM field is set to HIGH_PRIORITY.

Otherwise, if the properties.AssetValue log field value is equal to Medium, then the entity.security_result.priority UDM field is set to MEDIUM_PRIORITY.

Otherwise, if the properties.AssetValue log field value is equal to Low, then the entity.security_result.priority UDM field is set to LOW_PRIORITY.

Otherwise, the properties.AssetValue log field is mapped to the entity.security_result.detection_fields.asset_value UDM field.
properties.Timestamp metadata.creation_timestamp
metadata.entity_type The metadata.entity_type UDM field is set to ASSET.
properties.DeviceId metadata.product_entity_id The metadata.product_entity_id is set to DeviceID:%{properties.DeviceId}.
relations.direction The relations.direction UDM field is set to UNIDIRECTIONAL.
relations.entity_type The relations.entity_type UDM field is set to USER.
relations.relationship The relations.relationship UDM field is set to MEMBER.
properties.LoggedOnUsers.DomainName relations.entity.domain.name
properties.LoggedOnUsers.UserName relations.entity.user.userid
properties.LoggedOnUsers.Sid relations.entity.user.windows_sid
properties.LoggedOnUsers

字段映射参考信息：MICROSOFT DEFENDER ENDPOINT - IdentityLogonEvents

下表列出了 IdentityLogonEvents 日志类型的日志字段及其对应的 UDM 字段：

Log field UDM mapping Logic
properties.ActionType security_result.action If the properties.ActionType log field value matches the regular expression pattern (?i)LogonSuccess, then the security_result.action UDM field is set to ALLOW.
Otherwise, if the properties.ActionType log field value matches the regular expression pattern (?i)LogonBlocked, then the security_result.action UDM field is set to BLOCK.
Otherwise, if the properties.ActionType log field value matches the regular expression pattern (?i)LogonFailed, then the security_result.action UDM field is set to FAIL.
Otherwise, the security_result.action UDM field is set to UNKNOWN_ACTION.
properties.LogonType extensions.auth.mechanism If the properties.LogonType log field value is equal to Interactive, then the extensions.auth.mechanism UDM field is set to INTERACTIVE.
Otherwise, if the properties.LogonType log field value is equal to Network, then the extensions.auth.mechanism UDM field is set to NETWORK.
Otherwise, if the properties.LogonType log field value is equal to Batch, then the extensions.auth.mechanism UDM field is set to BATCH.
Otherwise, if the properties.LogonType log field value is equal to Service, then the extensions.auth.mechanism UDM field is set to SERVICE.
Otherwise, if the properties.LogonType log field value is equal to RemoteInteractive, then the extensions.auth.mechanism UDM field is set to REMOTE_INTERACTIVE.
Otherwise, the extensions.auth.mechanism UDM field is set to MECHANISM_UNSPECIFIED and properties.LogonType is mapped to additional.fields[logon_type].
properties.Protocol network.ip_protocol If the properties.Protocol log field value is equal to Tcp, then the network.ip_protocol UDM field is set to TCP.

Otherwise, if the properties.Protocol log field value is equal to Udp, then the network.ip_protocol UDM field is set to UDP.

Otherwise, if the properties.Protocol log field value is equal to Icmp, then the network.ip_protocol UDM field is set to ICMP.

Otherwise, the network.ip_protocol UDM field is set to UNKNOWN_IP_PROTOCOL and properties.Protocol is mapped to additional.fields[network_protocol].
properties.AccountDisplayName principal.user.user_display_name
properties.Location principal.location.name
properties.OSPlatform principal.asset.platform_software.platform If the properties.OSPlatform log field value matches the regular expression pattern (?i)macos, then the principal.asset.platform_software.platform UDM field is set to MAC.
Otherwise, if the properties.OSPlatform log field value matches the regular expression pattern (?i)windows, then the principal.asset.platform_software.platform UDM field is set to WINDOWS.
Otherwise, if the properties.OSPlatform log field value matches the regular expression pattern (?i)linux, then the principal.asset.platform_software.platform UDM field is set to LINUX.
properties.OSPlatform principal.asset.platform_software.platform_version
properties.DeviceType principal.asset.type If the properties.DeviceType log field value is equal to NetworkDevice, then the principal.asset.type UDM field is set to NETWORK_ATTACHED_STORAGE.
Otherwise, if the properties.DeviceType log field value is equal to Workstation, then the principal.asset.type UDM field is set to WORKSTATION.
Otherwise, if the properties.DeviceType log field value is equal to Server, then the principal.asset.type UDM field is set to SERVER.
Otherwise, if the properties.DeviceType log field value is equal to Mobile, then the principal.asset.type UDM field is set to MOBILE.
Otherwise, if the properties.DeviceType log field value is equal to Printer, then the principal.asset.type UDM field is set to PRINTER.
Otherwise, the principal.asset.type UDM field is set to ROLE_UNSPECIFIED and properties.DeviceType is mapped to principal.asset.attribute.labels[device_type].
properties.ISP network.carrier_name
properties.DestinationDeviceName intermediary.hostname
properties.TargetDeviceName target.hostname
properties.FailureReason security_result.description
properties.Port principal.port
properties.DestinationPort intermediary.port
properties.DestinationIPAddress intermediary.ip
properties.TargetAccountDisplayName target.user.user_display_name
properties.Application principal.application
metadata.event_type The metadata.event_type UDM field is set to USER_LOGIN.
properties.DeviceName principal.hostname If the properties.DeviceName log field value is not empty, then the properties.DeviceName log field is mapped to the principal.hostname UDM field.
properties.IPAddress principal.ip If the properties.IPAddress log field value is not empty, then the properties.IPAddress log field is mapped to the principal.asset.ip UDM field.
properties.AccountDomain principal.administrative_domain
properties.AdditionalFields additional.fields[additionalfields]
properties.AccountObjectId principal.user.product_object_id
properties.AccountUpn principal.user.email_addresses
properties.AccountName principal.user.userid
properties.AccountSid principal.user.windows_sid
properties.Timestamp metadata.event_timestamp
properties.ReportId metadata.product_log_id

字段映射参考信息：MICROSOFT DEFENDER ENDPOINT - DeviceLogonEvents

下表列出了 DeviceLogonEvents 日志类型的日志字段及其对应的 UDM 字段：

Log field UDM mapping Logic
properties.ActionType security_result.action If the properties.ActionType log field value matches the regular expression pattern (?i)LogonSuccess, then the security_result.action UDM field is set to ALLOW.
Otherwise, if the properties.ActionType log field value matches the regular expression pattern (?i)LogonFailed or (?i)LogonAttempted, then the security_result.action UDM field is set to FAIL.
Otherwise, the security_result.action UDM field is set to UNKNOWN_ACTION.
properties.InitiatingProcessSessionId additional.fields[initiating_process_session_id]
properties.IsInitiatingProcessRemoteSession additional.fields[is_initiating_process_remote_session]
properties.InitiatingProcessRemoteSessionDeviceName src.hostname
properties.InitiatingProcessRemoteSessionIP src.ip
properties.LogonType extensions.auth.mechanism If the properties.LogonType log field value is equal to Interactive, then the extensions.auth.mechanism UDM field is set to INTERACTIVE.

Otherwise, if the properties.LogonType log field value is equal to Network, then the extensions.auth.mechanism UDM field is set to NETWORK.

Otherwise, if the properties.LogonType log field value is equal to Batch, then the extensions.auth.mechanism UDM field is set to BATCH.

Otherwise, if the properties.LogonType log field value is equal to Service, then the extensions.auth.mechanism UDM field is set to SERVICE.

Otherwise, if the properties.LogonType log field value is equal to CachedInteractive, then the extensions.auth.mechanism UDM field is set to CACHED_INTERACTIVE.

Otherwise, if the properties.LogonType log field value is equal to CachedRemoteInteractive, then the extensions.auth.mechanism UDM field is set to CACHED_REMOTE_INTERACTIVE.

Otherwise, if the properties.LogonType log field value is equal to NetworkCleartext, then the extensions.auth.mechanism UDM field is set to NETWORK_CLEAR_TEXT.

Otherwise, if the properties.LogonType log field value is equal to NewCredentials, then the extensions.auth.mechanism UDM field is set to NEW_CREDENTIALS.

Otherwise, if the properties.LogonType log field value is equal to Local, then the extensions.auth.mechanism UDM field is set to LOCAL.

Otherwise, if the properties.LogonType log field value is equal to Unlock, then the extensions.auth.mechanism UDM field is set to UNLOCK.

Otherwise, if the properties.LogonType log field value is equal to RemoteInteractive, then the extensions.auth.mechanism UDM field is set to REMOTE_INTERACTIVE.

Otherwise, the extensions.auth.mechanism UDM field is set to MECHANISM_UNSPECIFIED.
properties.Timestamp metadata.event_timestamp
metadata.event_type The metadata.event_type UDM field is set to USER_LOGIN.
properties.ReportId metadata.product_log_id
properties.Protocol network.ip_protocol If the properties.Protocol log field value is equal to Tcp, then the network.ip_protocol UDM field is set to TCP.

If the properties.Protocol log field value is equal to Udp, then the network.ip_protocol UDM field is set to UDP.

If the properties.Protocol log field value is equal to Icmp, then the network.ip_protocol UDM field is set to ICMP.
properties.LogonId extensions.auth.auth_details
properties.InitiatingProcessAccountDomain principal.administrative_domain
properties.DeviceId target.asset_id The target.asset_id is set to DeviceID:%{properties.DeviceId}.
properties.DeviceName target.hostname
properties.InitiatingProcessCommandLine principal.process.command_line
properties.InitiatingProcessFolderPath principal.process.file.full_path If the properties.InitiatingProcessFolderPath log field value matches the regular expression pattern the properties.InitiatingProcessFileName log field value, then the properties.InitiatingProcessFolderPath log field is mapped to the principal.process.file.full_path UDM field.

Otherwise, the principal.process.file.full_path is set to %{properties.InitiatingProcessFolderPath}/%{properties.InitiatingProcessFileName}.
properties.InitiatingProcessMD5 principal.process.file.md5 If the properties.InitiatingProcessMD5 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.InitiatingProcessMD5 log field is mapped to the principal.process.file.md5 UDM field.
properties.InitiatingProcessFileName principal.process.file.names
properties.InitiatingProcessSHA1 principal.process.file.sha1 If the properties.InitiatingProcessSHA1 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.InitiatingProcessSHA1 log field is mapped to the principal.process.file.sha1 UDM field.
properties.InitiatingProcessSHA256 principal.process.file.sha256 If the properties.InitiatingProcessSHA256 log field value matches the regular expression pattern ^[a-f0-9]{64}$, then the properties.InitiatingProcessSHA256 log field is mapped to the principal.process.file.sha256 UDM field.
properties.InitiatingProcessFileSize principal.process.file.size
properties.InitiatingProcessParentFileName principal.process.parent_process.file.names
properties.InitiatingProcessParentId principal.process.parent_process.pid
properties.InitiatingProcessId principal.process.pid
properties.InitiatingProcessTokenElevation principal.process.token_elevation_type If the properties.InitiatingProcessTokenElevation log field value is equal to TokenElevationTypeFull, then the principal.process.token_elevation_type UDM field is set to TYPE_1.

Otherwise, if the properties.InitiatingProcessTokenElevation log field value is equal to TokenElevationTypeDefault, then the principal.process.token_elevation_type UDM field is set to TYPE_2.

Otherwise, if the properties.InitiatingProcessTokenElevation log field value is equal to TokenElevationTypeLimited, then the principal.process.token_elevation_type UDM field is set to TYPE_3.
properties.InitiatingProcessAccountObjectId principal.user.product_object_id
properties.InitiatingProcessAccountUpn principal.user.user_display_name
properties.InitiatingProcessAccountName principal.user.userid
properties.InitiatingProcessAccountSid principal.user.windows_sid
properties.FailureReason security_result.description
properties.AccountDomain target.administrative_domain
properties.RemoteDeviceName principal.hostname
properties.RemoteIP principal.ip
properties.RemotePort principal.port
properties.IsLocalAdmin target.resource.attribute.labels[is_local_admin]
properties.AccountName target.user.userid
properties.AccountSid target.user.windows_sid
properties.RemoteIPType additional.fields[remote_ip_type]
properties.AdditionalFields additional.fields[additional_fields]
properties.AppGuardContainerId additional.fields[app_guard_container_id]
properties.InitiatingProcessCreationTime additional.fields[initiating_process_creation_time]
properties.InitiatingProcessIntegrityLevel additional.fields[initiating_process_integrity_level]
properties.InitiatingProcessVersionInfoCompanyName principal.process.file.exif_info.company
properties.InitiatingProcessVersionInfoFileDescription principal.process.file.exif_info.file_description
properties.InitiatingProcessVersionInfoInternalFileName additional.fields[initiating_process_version_info_internal_file_name]
properties.InitiatingProcessVersionInfoOriginalFileName principal.process.file.exif_info.original_file
properties.InitiatingProcessVersionInfoProductName principal.process.file.exif_info.product
properties.InitiatingProcessVersionInfoProductVersion additional.fields[initiating_process_version_info_product_version]
properties.InitiatingProcessParentCreationTime additional.fields[initiating_process_parent_creation_time]

字段映射参考信息：MICROSOFT DEFENDER ENDPOINT - DeviceNetworkEvents

下表列出了 DeviceNetworkEvents 日志类型的日志字段及其对应的 UDM 字段：

Log field UDM mapping Logic
properties.ActionType security_result.summary
properties.InitiatingProcessSessionId additional.fields[initiating_process_session_id]
properties.IsInitiatingProcessRemoteSession additional.fields[is_initiating_process_remote_session]
properties.InitiatingProcessRemoteSessionDeviceName src.hostname
properties.InitiatingProcessRemoteSessionIP src.ip
properties.Timestamp metadata.event_timestamp
metadata.event_type The metadata.event_type UDM field is set to NETWORK_CONNECTION.
properties.ReportId metadata.product_log_id
properties.Protocol network.ip_protocol If the properties.Protocol log field value is equal to Tcp, then the network.ip_protocol UDM field is set to TCP.

Otherwise, if the properties.Protocol log field value is equal to Udp, then the network.ip_protocol UDM field is set to UDP.

Otherwise, if the properties.Protocol log field value is equal to Icmp, then the network.ip_protocol UDM field is set to ICMP.
properties.InitiatingProcessAccountDomain principal.administrative_domain
properties.DeviceId principal.asset_id The principal.asset_id is set to DeviceID:%{properties.DeviceId}.
properties.DeviceName principal.hostname
properties.LocalIP principal.ip
properties.LocalPort principal.port
properties.InitiatingProcessCommandLine principal.process.command_line
properties.InitiatingProcessFolderPath principal.process.file.full_path If the properties.InitiatingProcessFolderPath log field value matches the regular expression pattern the properties.InitiatingProcessFileName log field value, then the properties.InitiatingProcessFolderPath log field is mapped to the principal.process.file.full_path UDM field.

Otherwise, the principal.process.file.full_path is set to %{properties.InitiatingProcessFolderPath}/%{properties.InitiatingProcessFileName}.
properties.InitiatingProcessMD5 principal.process.file.md5 If the properties.InitiatingProcessMD5 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.InitiatingProcessMD5 log field is mapped to the principal.process.file.md5 UDM field.
properties.InitiatingProcessFileName principal.process.file.names
properties.InitiatingProcessSHA1 principal.process.file.sha1 If the properties.InitiatingProcessSHA1 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.InitiatingProcessSHA1 log field is mapped to the principal.process.file.sha1 UDM field.
properties.InitiatingProcessSHA256 principal.process.file.sha256 If the properties.InitiatingProcessSHA256 log field value matches the regular expression pattern ^[a-f0-9]{64}$, then the properties.InitiatingProcessSHA256 log field is mapped to the principal.process.file.sha256 UDM field.
properties.InitiatingProcessFileSize principal.process.file.size
properties.InitiatingProcessParentFileName principal.process.parent_process.file.names
properties.InitiatingProcessParentId principal.process.parent_process.pid
properties.InitiatingProcessId principal.process.pid
properties.InitiatingProcessTokenElevation principal.process.token_elevation_type If the properties.InitiatingProcessTokenElevation log field value is equal to TokenElevationTypeFull, then the principal.process.token_elevation_type UDM field is set to TYPE_1.

Otherwise, if the properties.InitiatingProcessTokenElevation log field value is equal to TokenElevationTypeDefault, then the principal.process.token_elevation_type UDM field is set to TYPE_2.

Otherwise, if the properties.InitiatingProcessTokenElevation log field value is equal to TokenElevationTypeLimited, then the principal.process.token_elevation_type UDM field is set to TYPE_3.
properties.InitiatingProcessAccountObjectId principal.user.product_object_id
properties.InitiatingProcessAccountUpn principal.user.user_display_name
properties.InitiatingProcessAccountName principal.user.userid
properties.InitiatingProcessAccountSid principal.user.windows_sid
properties.RemoteIP target.ip
properties.RemotePort target.port
properties.RemoteUrl target.url
properties.LocalIPType additional_fields[LocalIPType]
properties.RemoteIPType additional_fields[RemoteIPType]
properties.AdditionalFields additional.fields[additional_fields]
properties.AppGuardContainerId additional.fields[app_guard_container_id]
properties.InitiatingProcessCreationTime additional.fields[initiating_process_creation_time]
properties.InitiatingProcessIntegrityLevel additional.fields[initiating_process_integrity_level]
properties.InitiatingProcessParentCreationTime additional.fields[initiating_process_parent_creation_time]
properties.InitiatingProcessVersionInfoCompanyName principal.process.file.exif_info.company
properties.InitiatingProcessVersionInfoFileDescription principal.process.file.exif_info.file_description
properties.InitiatingProcessVersionInfoInternalFileName additional.fields[initiating_process_version_info_internal_file_name]
properties.InitiatingProcessVersionInfoOriginalFileName principal.process.file.exif_info.original_file
properties.InitiatingProcessVersionInfoProductName principal.process.file.exif_info.product
properties.InitiatingProcessVersionInfoProductVersion additional.fields[initiating_process_version_info_product_version]

字段映射参考信息：MICROSOFT DEFENDER ENDPOINT - DeviceNetworkInfo

下表列出了 DeviceNetworkInfo 日志类型的日志字段及其对应的 UDM 字段：

Log field UDM mapping Logic
properties.NetworkAdapterDnsSuffix entity.asset.attribute.labels[network_adapter_dns_suffix]
properties.OnboardingStatus entity.asset.attribute.labels[onboarding_status]
properties.DeviceId entity.asset_id The entity.asset_id is set to DeviceID:%{properties.DeviceId}.
properties.DeviceId entity.asset.asset_id The entity.asset.asset_id is set to DeviceID:%{properties.DeviceId}.
properties.ReportId entity.asset.attribute.labels[report_id]
properties.ConnectedNetworks entity.asset.attribute.labels[connected_networks]
properties.MacAddress entity.asset.mac
properties.NetworkAdapterName entity.asset.attribute.labels[network_adapter_name]
properties.NetworkAdapterStatus entity.asset.attribute.labels[network_adapter_status]
properties.NetworkAdapterType entity.asset.attribute.labels[network_adapter_type]
properties.NetworkAdapterVendor entity.asset.attribute.labels[network_adapter_vendor]
properties.TunnelType entity.asset.attribute.labels[tunnel_type]
properties.DefaultGateways entity.asset.attribute.labels[default_gateways]
properties.DeviceName entity.asset.hostname
properties.IPAddresses entity.asset.ip
entity.asset.type The entity.asset.type UDM field is set to WORKSTATION.
properties.DnsAddresses entity.domain.last_dns_records.type The entity.domain.last_dns_records.type UDM field is set to ip_address.
properties.DnsAddresses entity.domain.last_dns_records.value The properties.DnsAddresses log field is mapped to the entity.domain.last_dns_records.value UDM field.
properties.IPv4Dhcp entity.network.dhcp.ciaddr If the properties.IPv4Dhcp log field value is not empty, then the properties.IPv4Dhcp log field is mapped to the entity.network.dhcp.ciaddr UDM field.

Otherwise, the properties.IPv6Dhcp log field is mapped to the entity.network.dhcp.ciaddr UDM field.
properties.Timestamp metadata.creation_time
metadata.entity_type The metadata.entity_type UDM field is set to ASSET.
properties.DeviceId metadata.product_entity_id The metadata.product_entity_id is set to DeviceID:%{properties.DeviceId}.

字段映射参考信息：MICROSOFT DEFENDER ENDPOINT - DeviceProcessEvents

下表列出了 DeviceProcessEvents 日志类型的日志字段及其对应的 UDM 字段：

Log field UDM mapping Logic
properties.InitiatingProcessSessionId additional.fields[initiating_process_session_id]
properties.IsInitiatingProcessRemoteSession additional.fields[is_initiating_process_remote_session]
properties.InitiatingProcessRemoteSessionDeviceName src.hostname If properties.InitiatingProcessRemoteSessionDeviceName log field is not empty, then properties.InitiatingProcessRemoteSessionDeviceName log field is mapped to src.hostname UDM field.
properties.ProcessRemoteSessionDeviceName src.hostname If properties.InitiatingProcessRemoteSessionDeviceName log field is empty, then properties.ProcessRemoteSessionDeviceName log field is mapped to src.hostname UDM field.
properties.InitiatingProcessRemoteSessionIP src.ip
properties.ProcessRemoteSessionIP src.ip
properties.CreatedProcessSessionId additional.fields[created_process_session_id]
properties.IsProcessRemoteSession additional.fields[is_process_remote_session]
properties.Timestamp metadata.event_timestamp
properties.ActionType metadata.event_type If the properties.ActionType log field value matches the regular expression pattern (?i)ProcessCreated, then the metadata.event_type UDM field is set to PROCESS_LAUNCH.

Otherwise, if the properties.ActionType log field value matches the regular expression pattern (?i)OpenProcess, then the metadata.event_type UDM field is set to PROCESS_OPEN.
properties.ReportId metadata.product_log_id
properties.LogonId network.session_id
properties.InitiatingProcessAccountDomain principal.administrative_domain
properties.DeviceId principal.asset_id The principal.asset_id is set to DeviceID:%{properties.DeviceId}.
properties.DeviceName principal.hostname
properties.InitiatingProcessCommandLine principal.process.command_line
properties.InitiatingProcessFolderPath principal.process.file.full_path If the properties.InitiatingProcessFolderPath log field value matches the regular expression pattern the properties.InitiatingProcessFileName log field value, then the properties.InitiatingProcessFolderPath log field is mapped to the principal.process.file.full_path UDM field.

Otherwise, the principal.process.file.full_path is set to %{properties.InitiatingProcessFolderPath}/%{properties.InitiatingProcessFileName}.
properties.InitiatingProcessMD5 principal.process.file.md5 If the properties.InitiatingProcessMD5 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.InitiatingProcessMD5 log field is mapped to the principal.process.file.md5 UDM field.
properties.InitiatingProcessFileName principal.process.file.names
properties.InitiatingProcessSHA1 principal.process.file.sha1 If the properties.InitiatingProcessSHA1 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.InitiatingProcessSHA1 log field is mapped to the principal.process.file.sha1 UDM field.
properties.InitiatingProcessSHA256 principal.process.file.sha256 If the properties.InitiatingProcessSHA256 log field value matches the regular expression pattern ^[a-f0-9]{64}$, then the properties.InitiatingProcessSHA256 log field is mapped to the principal.process.file.sha256 UDM field.
properties.InitiatingProcessSignatureStatus principal.process.file.signature_info.sigcheck.signers.status
properties.InitiatingProcessFileSize principal.process.file.size
properties.InitiatingProcessParentId principal.process.parent_process.pid
properties.InitiatingProcessParentFileName principal.process.parent_process.file.names
properties.InitiatingProcessId principal.process.pid
properties.InitiatingProcessTokenElevation principal.process.token_elevation_type If the properties.InitiatingProcessTokenElevation log field value is equal to TokenElevationTypeFull, then the principal.process.token_elevation_type UDM field is set to TYPE_1.

Otherwise, if the properties.InitiatingProcessTokenElevation log field value is equal to TokenElevationTypeDefault, then the principal.process.token_elevation_type UDM field is set to TYPE_2.

Otherwise, if the properties.InitiatingProcessTokenElevation log field value is equal to TokenElevationTypeLimited, then the principal.process.token_elevation_type UDM field is set to TYPE_3
properties.InitiatingProcessAccountObjectId principal.user.product_object_id
properties.InitiatingProcessAccountUpn principal.user.user_display_name
properties.InitiatingProcessAccountName principal.user.userid
properties.InitiatingProcessAccountSid principal.user.windows_sid
properties.AccountDomain target.administrative_domain
properties.FolderPath target.file.full_path If the properties.FolderPath log field value matches the regular expression pattern the properties.FileName log field value, then the properties.FolderPath log field is mapped to the target.file.full_path UDM field.

Otherwise, the target.file.full_path set to %{properties.FolderPath}/%{properties.FileName}.
properties.MD5 target.process.file.md5 If the properties.MD5 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.MD5 log field is mapped to the target.file.md5 UDM field.
properties.FileName target.process.file.names
properties.SHA1 target.process.file.sha1 If the properties.SHA1 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.SHA1 log field is mapped to the target.file.sha1 UDM field.
properties.SHA256 target.process.file.sha256 If the properties.SHA256 log field value matches the regular expression pattern ^[a-f0-9]{64}$, then the properties.SHA256 log field is mapped to the target.file.sha256 UDM field.
properties.FileSize target.process.file.size
properties.ProcessCommandLine target.process.command_line
properties.ProcessId target.process.pid
properties.ProcessTokenElevation target.process.token_elevation_type If the properties.ProcessTokenElevation log field value is equal to TokenElevationTypeFull, then the target.process.token_elevation_type UDM field is set to TYPE_1.

Otherwise, if the properties.ProcessTokenElevation log field value is equal to TokenElevationTypeDefault, then the target.process.token_elevation_type UDM field is set to TYPE_2.

Otherwise, if the properties.ProcessTokenElevation log field value is equal to TokenElevationTypeLimited, then the target.process.token_elevation_type UDM field is set to TYPE_3.
properties.ProcessIntegrityLevel target.resource.attribute.labels[process_integrity_level]
properties.AccountUpn target.user.user_display_name
properties.AccountName target.user.userid
properties.AccountSid target.user.windows_sid
properties.InitiatingProcessCreationTime additional.fields[initiating_process_creation_time]
properties.InitiatingProcessParentCreationTime additional.fields[initiating_process_parent_creation_time]
properties.AccountObjectId additional.fields[account_object_id]
properties.AdditionalFields additional.fields[additional_fields]
properties.AppGuardContainerId additional.fields[app_guard_container_id]
properties.InitiatingProcessIntegrityLevel additional.fields[initiating_process_integrity_level]
properties.InitiatingProcessLogonId additional.fields[initiating_process_logon_id]
properties.InitiatingProcessSignerType additional.fields[initiating_process_signer_type]
properties.InitiatingProcessVersionInfoCompanyName principal.process.file.exif_info.company
properties.InitiatingProcessVersionInfoFileDescription principal.process.file.exif_info.file_description
properties.InitiatingProcessVersionInfoInternalFileName additional.fields[initiating_process_version_info_internal_file_name]
properties.InitiatingProcessVersionInfoOriginalFileName principal.process.file.exif_info.original_file
properties.InitiatingProcessVersionInfoProductName principal.process.file.exif_info.product
properties.InitiatingProcessVersionInfoProductVersion additional.fields[initiating_process_version_info_product_version]
properties.ProcessCreationTime additional.fields[process_creation_time]
properties.ProcessVersionInfoCompanyName target.process.file.exif_info.company
properties.ProcessVersionInfoFileDescription target.process.file.exif_info.file_description
properties.ProcessVersionInfoInternalFileName additional.fields[process_version_info_internal_file_name]
properties.ProcessVersionInfoOriginalFileName target.process.file.exif_info.original_file
properties.ProcessVersionInfoProductName target.process.file.exif_info.product
properties.ProcessVersionInfoProductVersion additional.fields[process_version_info_product_version]

字段映射参考信息：MICROSOFT DEFENDER ENDPOINT - DeviceTvmInfoGathering

下表列出了 DeviceTvmInfoGathering 日志类型的日志字段及其对应的 UDM 字段：

Log field UDM mapping Logic
properties.Timestamp metadata.event_timestamp
metadata.event_type The metadata.event_type UDM field is set to SCAN_HOST.
properties.DeviceId principal.asset_id The principal.asset_id is set to DeviceID:%{properties.DeviceId}.
properties.OSPlatform principal.asset.platform_software.platform If the properties.OSPlatform log field value matches the regular expression pattern (?i)macos, then the principal.asset.platform_software.platform UDM field is set to MAC.

Otherwise, if the properties.OSPlatform log field value matches the regular expression pattern (?i)windows, then the principal.asset.platform_software.platform UDM field is set to WINDOWS.

Otherwise, if the properties.OSPlatform log field value matches the regular expression pattern (?i)linux, then the principal.asset.platform_software.platform UDM field is set to LINUX.
properties.OSPlatform principal.asset.platform_software.platform_version
properties.DeviceName principal.hostname
properties.LastSeenTime principal.asset.last_discover_time
properties.AdditionalFields additional.fields[additional_fields]

字段映射参考信息：MICROSOFT DEFENDER ENDPOINT - DeviceRegistryEvents

下表列出了 DeviceRegistryEvents 日志类型的日志字段及其对应的 UDM 字段：

Log field UDM mapping Logic
properties.InitiatingProcessSessionId additional.fields[initiating_process_session_id]
properties.IsInitiatingProcessRemoteSession additional.fields[is_initiating_process_remote_session]
properties.InitiatingProcessRemoteSessionDeviceName src.hostname
properties.InitiatingProcessRemoteSessionIP src.ip
properties.Timestamp metadata.event_timestamp
properties.ActionType metadata.event_type If the properties.ActionType log field value matches the regular expression pattern (?i)RegistryKeyCreated, then the metadata.event_type UDM field is set to REGISTRY_CREATION.

Otherwise, if the properties.ActionType log field value matches the regular expression pattern (?i)RegistryKeyDeleted, then the metadata.event_type UDM field is set to REGISTRY_DELETION.

Otherwise, if the properties.ActionType log field value matches the regular expression pattern (?i)RegistryKeyRenamed, then the metadata.event_type UDM field is set to REGISTRY_MODIFICATION.

Otherwise, if the properties.ActionType log field value matches the regular expression pattern (?i)RegistryValueDeleted, then the metadata.event_type UDM field is set to REGISTRY_DELETION.

Otherwise, if the properties.ActionType log field value matches the regular expression pattern (?i)RegistryValueSet, then the metadata.event_type UDM field is set to REGISTRY_MODIFICATION.

Otherwise, the metadata.event_type UDM field is set to REGISTRY_UNCATEGORIZED.
properties.ReportId metadata.product_log_id
properties.InitiatingProcessAccountDomain principal.administrative_domain
properties.DeviceId principal.asset_id The principal.asset_id is set to DeviceID:%{properties.DeviceId}.
properties.DeviceName principal.hostname
properties.InitiatingProcessCommandLine principal.process.command_line
properties.InitiatingProcessFolderPath principal.process.file.full_path If the properties.InitiatingProcessFolderPath log field value matches the regular expression pattern the properties.InitiatingProcessFileName log field value, then the properties.InitiatingProcessFolderPath log field is mapped to the principal.process.file.full_path UDM field.

Otherwise, the principal.process.file.full_path is set to %{properties.InitiatingProcessFolderPath}/%{properties.InitiatingProcessFileName}.
properties.InitiatingProcessMD5 principal.process.file.md5 If the properties.InitiatingProcessMD5 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.InitiatingProcessMD5 log field is mapped to the principal.process.file.md5 UDM field.
properties.InitiatingProcessFileName principal.process.file.names
properties.InitiatingProcessSHA1 principal.process.file.sha1 If the properties.InitiatingProcessSHA1 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.InitiatingProcessSHA1 log field is mapped to the principal.process.file.sha1 UDM field.
properties.InitiatingProcessSHA256 principal.process.file.sha256 If the properties.InitiatingProcessSHA256 log field value matches the regular expression pattern ^[a-f0-9]{64}$, then the properties.InitiatingProcessSHA256 log field is mapped to the principal.process.file.sha256 UDM field.
properties.InitiatingProcessFileSize principal.process.file.size
properties.InitiatingProcessParentFileName principal.process.parent_process.file.names
properties.InitiatingProcessParentId principal.process.parent_process.pid
properties.InitiatingProcessId principal.process.pid
properties.PreviousRegistryValueData src.registry.registry_value_data
properties.PreviousRegistryKey src.registry.registry_key
properties.PreviousRegistryValueName src.registry.registry_value_name
properties.InitiatingProcessAccountObjectId principal.user.attribute.labels[initiating_process_account_object_id]
properties.InitiatingProcessAccountUpn principal.user.attribute.labels[initiating_process_account_upn]
properties.InitiatingProcessAccountName principal.user.userid
properties.InitiatingProcessAccountSid principal.user.windows_sid
properties.InitiatingProcessTokenElevation principal.process.token_elevation_type If the properties.InitiatingProcessTokenElevation log field value is equal to TokenElevationTypeFull, then the principal.process.token_elevation_type UDM field is set to TYPE_1.

Otherwise, if the properties.InitiatingProcessTokenElevation log field value is equal to TokenElevationTypeDefault, then the principal.process.token_elevation_type UDM field is set to TYPE_2.

Otherwise, if the properties.InitiatingProcessTokenElevation log field value is equal to TokenElevationTypeLimited, then the principal.process.token_elevation_type UDM field is set to TYPE_3.
properties.RegistryValueData target.registry.registry_value_data
properties.RegistryKey target.registry.registry_key
properties.RegistryValueName target.registry.registry_value_name
properties.InitiatingProcessCreationTime additional.fields[initiating_process_creation_time]
properties.InitiatingProcessIntegrityLevel additional.fields[initiating_process_integrity_level]
properties.InitiatingProcessParentCreationTime additional.fields[initiating_process_parent_creation_time]
properties.AppGuardContainerId additional.fields[app_guard_container_id]
properties.InitiatingProcessVersionInfoCompanyName principal.process.file.exif_info.company
properties.InitiatingProcessVersionInfoFileDescription principal.process.file.exif_info.file_description
properties.InitiatingProcessVersionInfoInternalFileName additional.fields[initiating_process_version_info_internal_file_name]
properties.InitiatingProcessVersionInfoOriginalFileName principal.process.file.exif_info.original_file
properties.InitiatingProcessVersionInfoProductName principal.process.file.exif_info.product
properties.InitiatingProcessVersionInfoProductVersion additional.fields[initiating_process_version_info_product_version]
properties.RegistryValueType additional.fields[registry_value_type]

字段映射参考信息：MICROSOFT DEFENDER ENDPOINT - DeviceTvmInfoGatheringKB

下表列出了 DeviceTvmInfoGatheringKB 日志类型的日志字段及其对应的 UDM 字段：

Log field UDM mapping Logic
properties.Description metadata.description
metadata.event_type The metadata.event_type UDM field is set to GENERIC_EVENT.
properties.IgId metadata.product_log_id
properties.Categories principal.resource.attribute.labels[categories]
properties.DataStructure principal.resource.attribute.labels[data_structure]
properties.FieldName principal.resource.name

字段映射参考信息：MICROSOFT DEFENDER ENDPOINT - DeviceTvmSecureConfigurationAssessment

下表列出了 DeviceTvmSecureConfigurationAssessment 日志类型的日志字段及其对应的 UDM 字段：

Log field UDM mapping Logic
properties.Timestamp metadata.event_timestamp
metadata.event_type The metadata.event_type UDM field is set to SCAN_UNCATEGORIZED.
properties.DeviceId principal.asset_id The principal.asset_id is set to DeviceID:%{properties.DeviceId}.
properties.OSPlatform principal.asset.platform_software.platform If the properties.OSPlatform log field value matches the regular expression pattern (?i)macos, then the principal.asset.platform_software.platform UDM field is set to MAC.

Otherwise, if the properties.OSPlatform log field value matches the regular expression pattern (?i)windows, then the principal.asset.platform_software.platform UDM field is set to WINDOWS.

Otherwise, if the properties.OSPlatform log field value matches the regular expression pattern (?i)linux, then the principal.asset.platform_software.platform UDM field is set to LINUX.
properties.DeviceName principal.hostname
properties.ConfigurationCategory principal.resource.attribute.labels[configuration_category]
properties.ConfigurationImpact principal.resource.attribute.labels[configuration_impact]
properties.Context principal.resource.attribute.labels[contex]
properties.IsApplicable principal.resource.attribute.labels[is_applicable]
properties.IsCompliant principal.resource.attribute.labels[is_compliant]
properties.IsExpectedUserImpact principal.resource.attribute.labels[is_expected_user_impact]
properties.ConfigurationId principal.resource.product_object_id
properties.ConfigurationSubcategory principal.resource.resource_subtype
principal.resource.resource_type The principal.resource.resource_type UDM field is set to ACCESS_POLICY.

字段映射参考信息：MICROSOFT DEFENDER ENDPOINT - DeviceTvmSecureConfigurationAssessmentKB

下表列出了 DeviceTvmSecureConfigurationAssessmentKB 日志类型的日志字段及其对应的 UDM 字段：

Log field UDM mapping Logic
metadata.event_type The metadata.event_type UDM field is set to GENERIC_EVENT.
properties.ConfigurationBenchmarks principal.resource.attribute.labels[configuration_benchmarks]
properties.ConfigurationCategory principal.resource.attribute.labels[configuration_category]
properties.ConfigurationDescription principal.resource.attribute.labels[configuration_description]
properties.ConfigurationImpact principal.resource.attribute.labels[configuration_impact]
properties.RemediationOptions principal.resource.attribute.labels[remediation_options]
properties.RiskDescription principal.resource.attribute.labels[risk_description]
properties.Tags principal.resource.attribute.labels[tags]
properties.ConfigurationName principal.resource.name
properties.ConfigurationId principal.resource.product_object_id
properties.ConfigurationSubcategory principal.resource.resource_subtype
principal.resource.resource_type The principal.resource.resource_type UDM field is set to ACCESS_POLICY.

字段映射参考信息：MICROSOFT DEFENDER ENDPOINT - DeviceTvmSoftwareEvidenceBeta

下表列出了 DeviceTvmSoftwareEvidenceBeta 日志类型的日志字段及其对应的 UDM 字段：

Log field UDM mapping Logic
metadata.event_type The metadata.event_type UDM field is set to GENERIC_EVENT.
properties.DeviceId principal.asset_id The principal.asset_id is set to DeviceID:%{properties.DeviceId}.
properties.DiskPaths principal.asset.attribute.labels[disk_paths] The properties.DiskPaths log field is mapped to the principal.asset.attribute.labels.disk_paths UDM field.
properties.RegistryPaths principal.asset.attribute.labels[registry_paths] The properties.RegistryPaths log field is mapped to the principal.asset.attribute.labels.registry_paths UDM field.
properties.LastSeenTime principal.asset.last_discover_time
properties.SoftwareName principal.asset.software.name
properties.SoftwareVendor principal.asset.software.vendor_name
properties.SoftwareVersion principal.asset.software.version

字段映射参考信息：MICROSOFT DEFENDER ENDPOINT - DeviceTvmSoftwareInventory

下表列出了 DeviceTvmSoftwareInventory 日志类型的日志字段及其对应的 UDM 字段：

Log field UDM mapping Logic
metadata.event_type The metadata.event_type UDM field is set to GENERIC_EVENT.
properties.DeviceId principal.asset_id The principal.asset_id is set to DeviceID:%{properties.DeviceId}.
properties.EndOfSupportDate principal.asset.attribute.labels[end_of_support_date]
properties.EndOfSupportStatus principal.asset.attribute.labels[end_of_support_status]
properties.OSArchitecture principal.asset.attribute.labels[os_architecture]
properties.ProductCodeCpe principal.asset.attribute.labels[product_code_cpe]
properties.OSPlatform principal.asset.platform_software.platform If the properties.OSPlatform log field value matches the regular expression pattern (?i)macos, then the principal.asset.platform_software.platform UDM field is set to MAC.

Otherwise, if the properties.OSPlatform log field value matches the regular expression pattern (?i)windows, then the principal.asset.platform_software.platform UDM field is set to WINDOWS.

Otherwise, if the properties.OSPlatform log field value matches the regular expression pattern (?i)linux, then the principal.asset.platform_software.platform UDM field is set to LINUX.
properties.OSVersion principal.asset.platform_software.platform_version
properties.SoftwareName principal.asset.software.name
properties.SoftwareVendor principal.asset.software.vendor_name
properties.SoftwareVersion principal.asset.software.version
properties.DeviceName principal.hostname

字段映射参考信息：MICROSOFT DEFENDER ENDPOINT - DeviceTvmSoftwareVulnerabilities

下表列出了 DeviceTvmSoftwareVulnerabilities 日志类型的日志字段及其对应的 UDM 字段：

Log field UDM mapping Logic
properties.CveId extensions.vulns.vulnerabilities.cve_id
properties.VulnerabilityLevel extensions.vulns.vulnerabilities.severity If the properties.VulnerabilityLevel log field value is equal to High, then the extensions.vulns.vulnerabilities.severity UDM field is set to HIGH.

Otherwise, if the properties.VulnerabilityLevel log field value is equal to Medium, then the extensions.vulns.vulnerabilities.severity UDM field is set to MEDIUM.

Otherwise, if the properties.VulnerabilityLevel log field value is equal to Low, then the extensions.vulns.vulnerabilities.severity UDM field is set to LOW.

Otherwise, if the properties.VulnerabilityLevel log field value is equal to Informational, then the extensions.vulns.vulnerabilities.severity UDM field is set to INFORMATIONAL.
properties.SeverityLevel extensions.vulns.vulnerablitities.severity_details
metadata.event_type The metadata.event_type UDM field is set to SCAN_VULN_HOST.
properties.DeviceId principal.asset_id The principal.asset_id is set to DeviceID:%{properties.DeviceId}.
properties.OSPlatform principal.asset.platform_software.platform If the properties.OSPlatform log field value matches the regular expression pattern (?i)macos, then the principal.asset.platform_software.platform UDM field is set to MAC.

Otherwise, if the properties.OSPlatform log field value matches the regular expression pattern (?i)windows, then the principal.asset.platform_software.platform UDM field is set to WINDOWS.

Otherwise, if the properties.OSPlatform log field value matches the regular expression pattern (?i)linux, then the principal.asset.platform_software.platform UDM field is set to LINUX.
properties.OSVersion principal.asset.platform_software.platform_version
properties.SoftwareName principal.asset.software.name
properties.SoftwareVendor principal.asset.software.vendor_name
properties.SoftwareVersion principal.asset.software.version
properties.DeviceName principal.hostname
properties.RecommendedSecurityUpdateId security_result.detection_fields[recommended_security_update_id]
properties.RecommendedSecurityUpdate security_result.detection_fields[recommended_security_update]
properties.CveTags additional.fields[cve_tags]

字段映射参考信息：MICROSOFT DEFENDER ENDPOINT - DeviceTvmSoftwareVulnerabilitiesKB

下表列出了 DeviceTvmSoftwareVulnerabilitiesKB 日志类型的日志字段及其对应的 UDM 字段：

Log field UDM mapping Logic
metadata.event_type The metadata.event_type UDM field is set to GENERIC_EVENT.
properties.CveId extensions.vulns.vulnerabilities.cve_id
properties.CvssScore extensions.vulns.vulnerablities.cvss_base_score
properties.IsExploitAvailable additional.fields[is_exploit_available]
properties.VulnerabilitySeverityLevel extensions.vulns.vulnerabilities.severity If the properties.VulnerabilitySeverityLevel log field value is equal to High, then the extensions.vulns.vulnerabilities.severity UDM field is set to HIGH.

Otherwise, if the properties.VulnerabilitySeverityLevel log field value is equal to Medium, then the extensions.vulns.vulnerabilities.severity UDM field is set to MEDIUM.

Otherwise, if the properties.VulnerabilitySeverityLevel log field value is equal to Low, then the extensions.vulns.vulnerabilities.severity UDM field is set to LOW.

Otherwise, if the properties.VulnerabilitySeverityLevel log field value is equal to Informational, then the extensions.vulns.vulnerabilities.severity UDM field is set to INFORMATIONAL.

Otherwise, the extensions.vulns.vulnerabilities.severity UDM field is set to UNKNOWN_SEVERITY.
properties.VulnerabilitySeverityLevel extensions.vulns.vulnerablitities.severity_details
properties.LastModifiedTime additional.fields[last_modified_time]
properties.PublishedDate additional.fields[published_date]
properties.VulnerabilityDescription extensions.vulns.vulnerabilities.cve_description
properties.AffectedSoftware target.application

字段映射参考信息：MICROSOFT DEFENDER ENDPOINT - EmailAttachmentInfo

下表列出了 EmailAttachmentInfo 日志类型的日志字段及其对应的 UDM 字段：

Log field UDM mapping Logic
properties.FileType target.file.mime_type
properties.FileName target.file.names
properties.SHA256 target.file.sha256 If the properties.SHA256 log field value matches the regular expression pattern ^[a-f0-9]{64}$, then the properties.SHA256 log field is mapped to the target.file.sha256 UDM field.
properties.FileSize target.file.size
properties.Timestamp metadata.event_timestamp
metadata.event_type The metadata.event_type UDM field is set to EMAIL_TRANSACTION.
properties.ReportId metadata.product_log_id
properties.SenderFromAddress network.email.from If the properties.SenderFromAddress log field value matches the regular expression pattern ^.+@.+$ and the length of the value is 256 characters or less, then the properties.SenderFromAddress log field is mapped to the network.email.from UDM field.

Otherwise, the additional.fields.key UDM field is set to SenderFromAddress and the properties.SenderFromAddress log field value is mapped to the additional.fields.value.string_value UDM field.
properties.SenderFromAddress principal.user.email_addresses
properties.NetworkMessageId network.email.mail_id
properties.RecipientEmailAddress network.email.to If the properties.RecipientEmailAddress log field value matches the regular expression pattern ^.+@.+$ and the length of the value is 256 characters or less, then the properties.RecipientEmailAddress log field is mapped to the network.email.to UDM field.

Otherwise, the additional.fields.key UDM field is set to RecipientEmailAddress and the properties.RecipientEmailAddress log field value is mapped to the additional.fields.value.string_value UDM field.
properties.RecipientEmailAddress target.user.email_addresses
properties.SenderObjectId principal.user.product_object_id
properties.SenderDisplayName principal.user.user_display_name
properties.ThreatTypes security_result.category If the properties.ThreatTypes log field value is equal to Phish, then the security_result.category UDM field is set to MAIL_PHISHING.

Otherwise, if the properties.ThreatTypes log field value is equal to Malware, then the security_result.category UDM field is set to SOFTWARE_MALICIOUS.

Otherwise, if the properties.ThreatTypes log field value is equal to Spam, then the security_result.category UDM field is set to MAIL_SPAM.

Otherwise, the security_result.category UDM field is set to UNKNOWN_CATEGORY.
properties.ThreatTypes security_result.category_details
properties.DetectionMethods security_result.detection_fields[detection_methods]
properties.ThreatNames security_result.threat_name
properties.RecipientObjectId target.user.product_object_id

字段映射参考信息：MICROSOFT DEFENDER ENDPOINT - EmailEvents

下表列出了 EmailEvents 日志类型的日志字段及其对应的 UDM 字段：

Log field UDM mapping Logic
properties.Timestamp metadata.event_timestamp
metadata.event_type The metadata.event_type UDM field is set to EMAIL_TRANSACTION.
properties.ReportId metadata.product_log_id
properties.EmailDirection network.direction If the properties.EmailDirection log field value is equal to Inbound, then the network.direction UDM field is set to INBOUND.

Otherwise, if the properties.EmailDirection log field value is equal to Outbound, then the network.direction UDM field is set to OUTBOUND.

Otherwise, the network.direction UDM field is set to UNKNOWN_DIRECTION, the additional.fields.key UDM field is set to EmailDirection, and the properties.EmailDirection log field value is mapped to the additional.fields.value.string_value UDM field.
properties.NetworkMessageId network.email.mail_id
properties.Subject network.email.subject
properties.RecipientEmailAddress network.email.to
properties.DistributionList network.email.to If the properties.DistributionList log field value matches the regular expression pattern ^.+@.+$ and the length of the value is 256 characters or less, then the properties.DistributionList log field is mapped to the network.email.to UDM field.

Otherwise, the additional.fields.key UDM field is set to DistributionList and the properties.DistributionList log field value is mapped to the additional.fields.value.string_value UDM field.
properties.SenderFromDomain principal.administrative_domain
properties.SenderIPv4 principal.ip
properties.SenderIPv6 principal.ip
properties.SenderMailFromAddress network.email.reply_to
properties.SenderFromAddress network.email.from If the properties.SenderFromAddress log field value matches the regular expression pattern ^.+@.+$ and the length of the value is 256 characters or less, then the properties.SenderFromAddress log field is mapped to the network.email.from UDM field.
Otherwise, the additional.fields.key UDM field is set to SenderFromAddress and the properties.SenderFromAddress log field value is mapped to the additional.fields.value.string_value UDM field.
properties.SenderFromAddress principal.user.email_addresses If the properties.SenderFromAddress log field value matches the regular expression pattern ^.+@.+$, then the properties.SenderFromAddress log field is mapped to the principal.user.email_addresses UDM field.
properties.SenderMailFromDomain principal.user.attribute.labels[sender_mail_from_domain]
properties.SenderObjectId principal.user.product_object_id
properties.SenderDisplayName principal.user.user_display_name
properties.ThreatTypes security_result.category If the properties.ThreatTypes log field value is equal to Phish, then the security_result.category UDM field is set to MAIL_PHISHING.

Otherwise, if the properties.ThreatTypes log field value is equal to Malware, then the security_result.category UDM field is set to SOFTWARE_MALICIOUS.

Otherwise, if the properties.ThreatTypes log field value is equal to Spam, then the security_result.category UDM field is set to MAIL_SPAM.

Otherwise, the security_result.category UDM field is set to UNKNOWN_CATEGORY.
properties.ThreatTypes security_result.category_details
properties.ConfidenceLevel security_result.confidence_details
properties.EmailAction security_result.description
properties.AuthenticationDetails security_result.detection_fields[authentication_details]
properties.BulkComplaintLevel security_result.detection_fields[bulk_complaint_level]
properties.DetectionMethods security_result.detection_fields[detection_methods]
properties.EmailActionPolicyGuid security_result.rule_id
properties.EmailActionPolicy security_result.rule_name
properties.ThreatNames security_result.threat_name
properties.OrgLevelAction security_result.rule_labels[org_level_action]
properties.OrgLevelPolicy security_result.rule_labels[org_level_policy]
properties.UserLevelAction security_result.rule_labels[user_level_action]
properties.UserLevelPolicy security_result.rule_labels[user_level_policy]
properties.RecipientEmailAddress network.email.to If the properties.RecipientEmailAddress log field value matches the regular expression pattern ^.+@.+$ and the length of the value is 256 characters or less, then the properties.RecipientEmailAddress log field is mapped to the network.email.to UDM field.

Otherwise, the additional.fields.key UDM field is set to RecipientEmailAddress and the properties.RecipientEmailAddress log field value is mapped to the additional.fields.value.string_value UDM field.
properties.RecipientEmailAddress target.user.email_addresses If the properties.RecipientEmailAddress log field value matches the regular expression pattern ^.+@.+$, then the properties.RecipientEmailAddress log field is mapped to the target.user.email_addresses UDM field.
properties.RecipientObjectId target.user.product_object_id
properties.AdditionalFields additional.fields[additional_fields]
properties.DeliveryAction security_result.action If the properties.DeliveryAction log field is equal to Delivered, then the security_result.action UDM field is set to ALLOW.

Otherwise, if the properties.DeliveryAction log field contains one of the following values:
  • Junked
  • Replaced
then the security_result.action UDM field is set to ALLOW_WITH_MODIFICATION.

Otherwise, if the properties.DeliveryAction log field is equal to Blocked, then the security_result.action UDM field is set to BLOCK.

Otherwise, the security_result.action UDM field is set to UNKNOWN_ACTION.
properties.DeliveryAction security_result.action_details
properties.DeliveryLocation additional.fields[delivery_location] The properties.DeliveryLocation log field is mapped to the additional.fields.delivery_location UDM field.
properties.EmailClusterId additional.fields[email_cluster_id]
properties.EmailLanguage additional.fields[email_language]
properties.InternetMessageId additional.fields[internet_message_id]
properties.LatestDeliveryLocation additional.fields[last_delivery_location]
properties.UrlCount additional.fields[url_count]
properties.Connectors additional.fields[connectors]
properties.AttachmentCount additional.fields[attachment_count]
properties.LatestDeliveryAction additional.fields[latest_delivery_action]

字段映射参考信息：MICROSOFT DEFENDER ENDPOINT - EmailPostDeliveryEvents

下表列出了 EmailPostDeliveryEvents 日志类型的日志字段及其对应的 UDM 字段：
Log field UDM mapping Logic
properties.Timestamp metadata.event_timestamp
metadata.event_type The metadata.event_type UDM field is set to EMAIL_TRANSACTION.
properties.ReportId security_result.detection_fields[report_id]
properties.NetworkMessageId network.email.mail_id
properties.ActionResult security_result.summary
properties.ThreatTypes security_result.category If the properties.ThreatTypes log field value is equal to Phish, then the security_result.category UDM field is set to MAIL_PHISHING.

Otherwise, if the properties.ThreatTypes log field value is equal to Malware, then the security_result.category UDM field is set to SOFTWARE_MALICIOUS.

Otherwise, if the properties.ThreatTypes log field value is equal to Spam, then the security_result.category UDM field is set to MAIL_SPAM.

Otherwise, the security_result.category UDM field is set to UNKNOWN_CATEGORY.
properties.ThreatTypes security_result.category_details
properties.ActionTrigger security_result.detection_fields[action_trigger]
properties.DeliveryLocation security_result.detection_fields[delivery_location]
properties.DetectionMethods security_result.detection_fields[detection_methods]
properties.Action security_result.action If the properties.Action log field is equal to Moved to quarantine, then the security_result.action UDM field is set to QUARANTINE.

Otherwise, if the properties.Action log field is equal to Added message info only, then the security_result.action UDM field is set to ALLOW_WITH_MODIFICATION.

Otherwise, if the properties.Action log field is equal to Quarantine release, then the security_result.action UDM field is set to ALLOW.

Otherwise, if the properties.Action log field is equal to Moved to junk folder, then the security_result.action UDM field is set to ALLOW_WITH_MODIFICATION.

Otherwise, if the properties.Action log field is equal to Reprocessed, then the security_result.action UDM field is set to CHALLENGE.

Otherwise, the security_result.action UDM field is set to UNKNOWN_ACTION.
properties.Action security_result.action_details
properties.ActionType security_result.verdict_info.verdict_type If the properties.ActionType log field value is equal to Manual Remediation, then the security_result.verdict_info.verdict_type UDM field is set to ANALYST_VERDICT.

Otherwise, if the properties.ActionType log field contains one of the following values, then the security_result.verdict_info.verdict_type UDM field is set to PROVIDER_ML_VERDICT.
  • Phish ZAP
  • Malware ZAP
  • Spam ZAP
.
properties.RecipientEmailAddress target.user.email_addresses If the properties.RecipientEmailAddress log field value matches the regular expression pattern ^.+@.+$, then the properties.RecipientEmailAddress log field is mapped to the target.user.email_addresses UDM field.
properties.InternetMessageId additional.fields[internet_message_id]

字段映射参考信息：MICROSOFT DEFENDER ENDPOINT - EmailUrlInfo

下表列出了 EmailUrlInfo 日志类型的日志字段及其对应的 UDM 字段：

Log field UDM mapping Logic
properties.UrlDomain target.hostname
properties.Url target.url
properties.Timestamp metadata.event_timestamp
metadata.event_type The metadata.event_type UDM field is set to EMAIL_TRANSACTION.
properties.ReportId metadata.product_log_id
properties.NetworkMessageId network.email.mail_id
properties.UrlLocation additional.fields[url_location]

字段映射参考信息：MICROSOFT DEFENDER ENDPOINT - IdentityInfo

下表列出了 IdentityInfo 日志类型的日志字段及其对应的 UDM 字段：

Log field UDM mapping Logic
properties.BlastRadius entity.user.attribute.labels[blast_radius]
properties.CompanyName entity.user.company_name
properties.CriticalityLevel entity.user.attribute.labels[criticality_level]
properties.DeletedDateTime entity.user.attribute.labels[deleted_date_time]
properties.EmployeeId entity.user.employee_id
properties.GroupMembership entity.user.group_identifiers
properties.IdentityEnvironment entity.user.attribute.labels[identity_environment]
properties.OnPremObjectId entity.user.attribute.labels[on_prem_object_id]
properties.OtherMailAddresses entity.user.email_addresses
properties.PrivilegedEntraPimRoles entity.user.attribute.roles.name
properties.RiskLevel entity.user.attribute.labels[risk_level]
properties.RiskLevelDetails entity.user.attribute.labels[risk_level_details]
properties.RiskStatus entity.user.attribute.labels[risk_status]
properties.SourceProviders entity.user.attribute.labels[source_providers]
properties.State entity.user.personal_address.state
properties.TenantMembershipType entity.user.attribute.labels[tenant_membership_type]
properties.UserAccountControl entity.user.attribute.labels[user_account_control]
properties.SourceSystem entity.resource.parent
properties.AccountDomain entity.administrative_domain
properties.TenantId entity.resource.product_object_id
properties.CreatedDateTime entity.user.attribute.creation_time
properties.AccountUpn entity.user.attribute.labels[account_upn]
properties.ChangeSource entity.user.attribute.labels[change_source]
properties.CloudSid entity.user.attribute.labels[cloud_sid]
properties.ReportId entity.user.attribute.labels[report_id]
properties.SipProxyAddress entity.user.attribute.labels[sip_proxy_address]
properties.SourceProvider entity.user.attribute.labels[source_provider]
properties.Tags entity.user.attribute.labels[tags]
properties.Type entity.user.account_type If the properties.Type log field is equal to User, then the entity.user.account_type UDM field is set to DOMAIN_ACCOUNT_TYPE.

Otherwise, if the properties.Type log field is equal to ServiceAccount, then the entity.user.account_type UDM field is set to SERVICE_ACCOUNT_TYPE.
properties.Type entity.user.attribute.labels[type]
properties.DistinguishedName entity.user.attributes.labels[distinguished_name]
properties.Department entity.user.department
properties.EmailAddress entity.user.email_addresses If the properties.EmailAddress log field value matches the regular expression pattern ^.+@.+$, then the properties.EmailAddress log field is mapped to the entity.user.email_addresses UDM field.
properties.GivenName entity.user.first_name
properties.Surname entity.user.last_name
properties.Manager entity.user.managers.user_display_name
properties.City entity.user.personal_address.city
properties.Country entity.user.personal_address.country_or_region
properties.Address entity.user.personal_address.name
properties.Phone entity.user.phone_numbers
properties.AccountObjectId entity.user.product_object_id
properties.AssignedRoles entity.user.role_description
properties.JobTitle entity.user.title
properties.IsAccountEnabled entity.user.user_authentication_status If the properties.IsAccountEnabled log field value is equal to 1 or true, then the entity.user.user_authentication_status UDM field is set to ACTIVE.

Otherwise, the entity.user.user_authentication_status UDM field is set to SUSPENDED.
properties.AccountDisplayName entity.user.user_display_name
properties.AccountName entity.user.userid
properties.OnPremSid entity.user.attribute.labels[on_prem_sid]
properties.Timestamp metadata.creation_time
metadata.entity_type The metadata.entity_type UDM field is set to USER.
properties.AccountObjectId metadata.product_entity_id

字段映射参考信息：MICROSOFT DEFENDER ENDPOINT - CloudAppEvents

下表列出了 CloudAppEvents 日志类型的日志字段及其对应的 UDM 字段：

Log field UDM mapping Logic
properties.Timestamp metadata.event_timestamp
metadata.event_type The metadata.event_type UDM field is set to GENERIC_EVENT.
properties.ActionType security_result.summary
properties.Application additional.fields[application]
properties.ApplicationId additional.fields[application_id]
properties.AppInstanceId additional.fields[app_instance_id]
properties.AccountObjectId principal.user.product_object_id
properties.AccountId principal.user.userid
properties.AccountDisplayName principal.user.user_display_name
properties.IsAdminOperation principal.user.attribute.role.type If the properties.IsAdminOperation is equal to true, then the principal.user.attribute.role.type is set to ADMINISTRATOR.
properties.DeviceType principal.asset.type If the properties.DeviceType log field value is equal to NetworkDevice, then the principal.asset.type UDM field is set to NETWORK_ATTACHED_STORAGE.
Otherwise, if the properties.DeviceType log field value is equal to Workstation, then the principal.asset.type UDM field is set to WORKSTATION.
Otherwise, if the properties.DeviceType log field value is equal to Server, then the principal.asset.type UDM field is set to SERVER.
Otherwise, if the properties.DeviceType log field value is equal to Mobile, then the principal.asset.type UDM field is set to MOBILE.
Otherwise, if the properties.DeviceType log field value is equal to Printer, then the principal.asset.type UDM field is set to PRINTER.
Otherwise, the principal.asset.type UDM field is set to ROLE_UNSPECIFIED and properties.DeviceType is mapped to principal.asset.attribute.labels[device_type].
properties.OSPlatform principal.asset.platform_software.platform If the properties.OSPlatform log field value matches the regular expression pattern (?i)macos, then the principal.asset.platform_software.platform UDM field is set to MAC.

Otherwise, if the properties.OSPlatform log field value matches the regular expression pattern (?i)windows, then the principal.asset.platform_software.platform UDM field is set to WINDOWS.

Otherwise, if the properties.OSPlatform log field value matches the regular expression pattern (?i)linux, then the principal.asset.platform_software.platform UDM field is set to LINUX.
properties.OSPlatform principal.asset.platform_software.platform_version
properties.IPAddresses principal.ip
properties.IsAnonymousProxy principal.asset.attribute.labels[is_anonymous_proxy] The properties.IsAnonymousProxy log field is mapped to the principal.asset.attribute.labels[is_anonymous_proxy] UDM field.
properties.CountryCode principal.ip_geo_artifact.location.country_or_region
properties.City principal.ip_geo_artifact.location.city
properties.Isp principal.asset.attribute.labels[isp] The properties.Isp log field is mapped to the principal.asset.attribute.labels[isp] UDM field.
properties.UserAgent network.http.user_agent
properties.ActivityType additional.fields[activity_type]
properties.ActivityObjects additional.fields[activity_objects]
properties.ObjectName target.resource.name
properties.ObjectType target.resource.resource_subtype
properties.ObjectId target.resource.product_object_id
properties.ReportId metadata.product_log_id
properties.AccountType principal.asset.attribute.labels[account_type] The properties.AccountType log field is mapped to the principal.asset.attribute.labels[account_type] UDM field.
properties.IsExternalUser principal.asset.attribute.labels[is_external_user] The properties.IsExternalUser log field is mapped to the principal.asset.attribute.labels[is_external_user] UDM field.
properties.IsImpersonated principal.asset.attribute.labels[is_impersonated] The properties.IsImpersonatedr log field is mapped to the principal.asset.attribute.labels[is_impersonated] UDM field.
properties.IPTags principal.asset.attribute.labels[ip_tags] The properties.IPTags log field is mapped to the principal.asset.attribute.labels[ip_tags] UDM field.
properties.IPCategory principal.asset.attribute.labels[ip_category] The properties.IPCategory log field is mapped to the principal.asset.attribute.labels[ip_category] UDM field.
properties.UserAgentTags principal.asset.attribute.labels[user_agent_tags] The properties.UserAgentTags log field is mapped to the principal.asset.attribute.labels[user_agent_tags] UDM field.
properties.RawEventData additional.fields[raw_event_data] Iterate for each key, value pair of log field properties.RawEventData, then
value log field is mapped to the additional.fields.key UDM field.
Iterate for each key1, value1 pair of log field value, then
value1 log field is mapped to the additional.fields.key UDM field.
Iterate for each key2, value2 pair of log field value1, then
value2 log field is mapped to the additional.fields.key UDM field.
Iterate for each key3, value3 pair of log field value2, then
value3 log field is mapped to the additional.fields.key UDM field.
properties.AdditionalFields additional.fields[additional_fields] Iterate for each key, value pair of log field properties.AdditionalFields, then
value log field is mapped to the additional.fields.key UDM field.
properties.LastSeenForUser additional.fields[last_seen_for_user] Iterate for each key, value pair of log field properties.LastSeenForUser, then
value log field is mapped to the additional.fields.key UDM field.
properties.UncommonForUser additional.fields[uncommon_for_user] Iterate for each key, value pair of log field properties.UncommonForUser, then
value log field is mapped to the additional.fields.key UDM field.
properties.AuditSource additional.fields[audit_source]
properties.SessionData additional.fields[session_data]
properties.OAuthAppId additional.fields[oauth_app_id]

AdditionalFields 映射参考

本部分介绍 Google Security Operations 解析器如何将 Microsoft Defender for Endpoint 的 AdditionalFields 原始日志字段中的嵌套字段映射到 Google Security Operations UDM 字段。

AdditionalFields 映射参考信息：MICROSOFT DEFENDER ENDPOINT - AlertEvidence

下表列出了 AlertEvidence 日志类型的 AdditionalFields 日志字段及其对应的 UDM 字段：

Entity Type Log field UDM mapping Logic
Process properties.AdditionalFields.Account.AadUserId target.user.attribute.labels[Account_AadUserId]
Process properties.AdditionalFields.Account.Name target.user.userid
Process properties.AdditionalFields.Account.Sid target.user.windows_sid
Process properties.AdditionalFields.Account.UserPrincipalName target.user.email_addresses
Process properties.AdditionalFields.ImageFile.Directory, properties.AdditionalFields.ImageFile.Name target.process.file.full_path If the properties.AdditionalFields.ImageFile.Directory log field value matches the regular expression pattern properties.AdditionalFields.ImageFile.Name, then the properties.AdditionalFields.ImageFile.Directory log field is mapped to the target.process.file.full_path UDM field.

Otherwise, %{properties.AdditionalFields.ImageFile.Directory}\%{properties.AdditionalFields.ImageFile.Name} is mapped to the target.process.file.full_path UDM field.
Process properties.AdditionalFields.ImageFile.FileHashes.$id additional.fields[ImageFile_FileHashes_$id] Iterate through log field properties.AdditionalFields.ImageFile.FileHashes:

The ImageFile_FileHashes_$id_%{index} value is mapped to the additional.fields.key UDM field.

The properties.AdditionalFields.ImageFile.FileHashes.$id log field value is mapped to the additional.fields.value.string_value UDM field.
Process properties.AdditionalFields.ImageFile.FileHashes.Algorithm additional.fields[ImageFile_FileHashes_Algorithm] Iterate through log field properties.AdditionalFields.ImageFile.FileHashes:

The ImageFile_FileHashes_Algorithm_%{index} value is mapped to the additional.fields.key UDM field.

The properties.AdditionalFields.ImageFile.FileHashes.Algorithm log field value is mapped to the additional.fields.value.string_value UDM field.
Process properties.AdditionalFields.ImageFile.FileHashes.Type additional.fields[ImageFile_FileHashes_Type] Iterate through log field properties.AdditionalFields.ImageFile.FileHashes:

The ImageFile_FileHashes_Type_%{index} value is mapped to the additional.fields.key UDM field.

The properties.AdditionalFields.ImageFile.FileHashes.Type log field value is mapped to the additional.fields.value.string_value UDM field.
Process properties.AdditionalFields.ImageFile.FileHashes.Value target.process.file.sha1 Iterate through log field properties.AdditionalFields.ImageFile.FileHashes:

if the properties.AdditionalFields.ImageFile.FileHashes.Algorithm log field value is equal to SHA1 and the properties.sha1 log field value is empty, then the properties.AdditionalFields.ImageFile.FileHashes.Value log field value is mapped to the target.process.file.sha1 UDM field.

Otherwise, if the properties.AdditionalFields.ImageFile.FileHashes.Algorithm log field value is equal to SHA256 and the properties.sha256 log field value is empty, then the properties.AdditionalFields.ImageFile.FileHashes.Value log field value is mapped to the target.process.file.sha256 UDM field.

Otherwise, if the properties.AdditionalFields.ImageFile.FileHashes.Algorithm log field value is equal to MD5 and the properties.md5 log field value is empty, then the properties.AdditionalFields.ImageFile.FileHashes.Value log field value is mapped to the target.process.file.md5 UDM field.

Otherwise, ImageFile_FileHashes_Value is mapped to the target.security_result.detection_fields.key UDM field and the properties.AdditionalFields.ImageFile.FileHashes.Value log field value is mapped to the target.security_result.detection_fields.value UDM field.
Process properties.AdditionalFields.ImageFile.Name target.process.file.names
Process properties.AdditionalFields.ParentProcess.$id additional.fields[ParentProcess_$id]
Process properties.AdditionalFields.ParentProcess.Account.$ref additional.fields[ParentProcess_Account_$ref]
Process properties.AdditionalFields.ParentProcess.CommandLine principal.process.command_line
Process properties.AdditionalFields.ParentProcess.CreationTimeUtc additional.fields[ParentProcess_CreationTimeUtc]
Process properties.AdditionalFields.ParentProcess.Host.$ref additional.fields[ParentProcess_Host_$ref]
Process properties.AdditionalFields.ParentProcess.ImageFile.$id additional.fields[ParentProcess_ImageFile_$id]
Process properties.AdditionalFields.ParentProcess.ImageFile.CreatedTimeUtc principal.process.file.create_time
Process properties.AdditionalFields.ParentProcess.ImageFile.Directory, properties.AdditionalFields.ParentProcess.ImageFile.Name principal.process.file.full_path If the properties.AdditionalFields.ParentProcess.ImageFile.Directory log field value matches the regular expression pattern properties.AdditionalFields.ParentProcess.ImageFile.Name, then the properties.AdditionalFields.ParentProcess.ImageFile.Directory log field is mapped to the principal.process.file.full_path UDM field.

Otherwise, %{properties.AdditionalFields.ParentProcess.ImageFile.Directory}\%{properties.AdditionalFields.ParentProcess.ImageFile.Name} is mapped to the principal.process.file.full_path UDM field.
Process properties.AdditionalFields.ParentProcess.ImageFile.FileHashes.$id additional.fields[ParentProcess_ImageFile_FileHashes_$id] Iterate through log field properties.AdditionalFields.ParentProcess.ImageFile.FileHashes:

The ParentProcess_ImageFile_FileHashes_$id_%{index} value is mapped to the additional.fields.key UDM field.

The properties.AdditionalFields.ParentProcess.ImageFile.FileHashes.$id log field value is mapped to the additional.fields.value.string_value UDM field.
Process properties.AdditionalFields.ParentProcess.ImageFile.FileHashes.Algorithm additional.fields[ParentProcess_ImageFile_FileHashes_Algorithm] Iterate through log field properties.AdditionalFields.ParentProcess.ImageFile.FileHashes:

The ParentProcess_ImageFile_FileHashes_Algorithm_%{index} value is mapped to the additional.fields.key UDM field.

The properties.AdditionalFields.ParentProcess.ImageFile.FileHashes.Algorithm log field value is mapped to the additional.fields.value.string_value UDM field.
Process properties.AdditionalFields.ParentProcess.ImageFile.FileHashes.Type additional.fields[ParentProcess_ImageFile_FileHashes_Type] Iterate through log field properties.AdditionalFields.ParentProcess.ImageFile.FileHashes:

The ParentProcess_ImageFile_FileHashes_Type_%{index} value is mapped to the additional.fields.key UDM field.

The properties.AdditionalFields.ParentProcess.ImageFile.FileHashes.Type log field value is mapped to the additional.fields.value.string_value UDM field.
Process properties.AdditionalFields.ParentProcess.ImageFile.FileHashes.Value principal.process.file.sha1 Iterate through log field properties.AdditionalFields.ParentProcess.ImageFile.FileHashes:

if the properties.AdditionalFields.ParentProcess.ImageFile.FileHashes.Algorithm log field value is equal to SHA1 and the properties.sha1 log field value is empty, then the properties.AdditionalFields.ParentProcess.ImageFile.FileHashes.Value log field value is mapped to the principal.process.file.sha1 UDM field.

Otherwise, if the properties.AdditionalFields.ParentProcess.ImageFile.FileHashes.Algorithm log field value is equal to SHA256 and the properties.sha256 log field value is empty, then the properties.AdditionalFields.ParentProcess.ImageFile.FileHashes.Value log field value is mapped to the principal.process.file.sha256 UDM field.

Otherwise, if the properties.AdditionalFields.ParentProcess.ImageFile.FileHashes.Algorithm log field value is equal to MD5 and the properties.md5 log field value is empty, then the properties.AdditionalFields.ParentProcess.ImageFile.FileHashes.Value log field value is mapped to the principal.process.file.md5 UDM field.

Otherwise, ParentProcess_ImageFile_FileHashes_Value is mapped to the principal.security_result.detection_fields.key UDM field and the properties.AdditionalFields.ParentProcess.ImageFile.FileHashes.Value log field value is mapped to the principal.security_result.detection_fields.value UDM field.
Process properties.AdditionalFields.ParentProcess.ImageFile.FirstSeen principal.process.file.first_seen_time
Process properties.AdditionalFields.ParentProcess.ImageFile.Host.$ref additional.fields[ParentProcess_ImageFile_Host_$ref]
Process properties.AdditionalFields.ParentProcess.ImageFile.IsPe additional.fields[ParentProcess_ImageFile_IsPe]
Process properties.AdditionalFields.ParentProcess.ImageFile.KnownPrevalence additional.fields[ParentProcess_ImageFile_known_prevalence]
Process properties.AdditionalFields.ParentProcess.ImageFile.LastAccessTimeUtc principal.process.file.last_access_time
Process properties.AdditionalFields.ParentProcess.ImageFile.LastWriteTimeUtc principal.process.file.last_modification_time
Process properties.AdditionalFields.ParentProcess.ImageFile.LsHash additional.fields[ParentProcess_ImageFile_LsHash]
Process properties.AdditionalFields.ParentProcess.ImageFile.Name principal.process.file.names
Process properties.AdditionalFields.ParentProcess.ImageFile.SizeInBytes principal.process.file.size
Process properties.AdditionalFields.ParentProcess.ImageFile.Type additional.fields[ParentProcess_ImageFile_Type]
Process properties.AdditionalFields.ParentProcess.ProcessId principal.process.pid
Process properties.AdditionalFields.ParentProcess.Type additional.fields[ParentProcess_Type]
Process properties.AdditionalFields.ParentProcess.ImageFile.HostUrl.$id additional.fields[ParentProcess_ImageFile_HostUrl_$id]
Process properties.AdditionalFields.ParentProcess.ImageFile.HostUrl.Type additional.fields[ParentProcess_ImageFile_HostUrl_Type]
Process properties.AdditionalFields.ParentProcess.ImageFile.HostUrl.Url src.url
Process properties.AdditionalFields.ParentProcess.ImageFile.IsDownloaded additional.fields[ParentProcess_ImageFile_IsDownloaded]
Process properties.AdditionalFields.ParentProcess.ImageFile.ReferrerUrl.$id additional.fields[ParentProcess_ImageFile_ReferrerUrl_$id]
Process properties.AdditionalFields.ParentProcess.ImageFile.ReferrerUrl.Type additional.fields[ParentProcess_ImageFile_ReferrerUrl_Type]
Process properties.AdditionalFields.ParentProcess.ImageFile.ReferrerUrl.Url security_result.detection_fields[ParentProcess_ImageFile_ReferrerUrl_Url]
Process properties.AdditionalFields.ParentProcess.ImageFile.WindowsSecurityZone additional.fields[ParentProcess_ImageFile_WindowsSecurityZone]

AdditionalFields 映射参考信息：MICROSOFT DEFENDER ENDPOINT - DeviceEvents

下表列出了 DeviceEvents 日志类型的 AdditionalFields 日志字段及其对应的 UDM 字段：

Log field UDM mapping Logic
properties.AdditionalFields.DnsQueryResult.Result network.dns.answers.data Iterate through log field properties.AdditionalFields.DnsQueryResult:

The properties.AdditionalFields.DnsQueryResult.Result log field value is mapped to the network.dns.answers.data UDM field.
properties.AdditionalFields.DnsQueryResult.DnsQueryType network.dns.answers.type Iterate through log field properties.AdditionalFields.DnsQueryResult:

if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to A, then the network.dns.answers.type UDM field is set to 1.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to NS, then the network.dns.answers.type UDM field is set to 2.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to MD, then the network.dns.answers.type UDM field is set to 3.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to MF, then the network.dns.answers.type UDM field is set to 4.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to CNAME, then the network.dns.answers.type UDM field is set to 5.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to SOA, then the network.dns.answers.type UDM field is set to 6.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to MB, then the network.dns.answers.type UDM field is set to 7.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to MG, then the network.dns.answers.type UDM field is set to 8.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to MR, then the network.dns.answers.type UDM field is set to 9.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to NULL, then the network.dns.answers.type UDM field is set to 10.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to WKS, then the network.dns.answers.type UDM field is set to 11.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to PTR, then the network.dns.answers.type UDM field is set to 12.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to HINFO, then the network.dns.answers.type UDM field is set to 13.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to MINFO, then the network.dns.answers.type UDM field is set to 14.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to MX, then the network.dns.answers.type UDM field is set to 15.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to TXT, then the network.dns.answers.type UDM field is set to 16.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to RP, then the network.dns.answers.type UDM field is set to 17.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to AFSDB, then the network.dns.answers.type UDM field is set to 18.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to X25, then the network.dns.answers.type UDM field is set to 19.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to ISDN, then the network.dns.answers.type UDM field is set to 20.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to RT, then the network.dns.answers.type UDM field is set to 21.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to NSAP, then the network.dns.answers.type UDM field is set to 22.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to NSAP-PTR, then the network.dns.answers.type UDM field is set to 23.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to SIG, then the network.dns.answers.type UDM field is set to 24.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to KEY, then the network.dns.answers.type UDM field is set to 25.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to PX, then the network.dns.answers.type UDM field is set to 26.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to GPOS, then the network.dns.answers.type UDM field is set to 27.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to AAAA, then the network.dns.answers.type UDM field is set to 28.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to LOC, then the network.dns.answers.type UDM field is set to 29.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to NXT, then the network.dns.answers.type UDM field is set to 30.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to EID, then the network.dns.answers.type UDM field is set to 31.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to NIMLOC, then the network.dns.answers.type UDM field is set to 32.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to SRV, then the network.dns.answers.type UDM field is set to 33.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to ATMA, then the network.dns.answers.type UDM field is set to 34.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to NAPTR, then the network.dns.answers.type UDM field is set to 35.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to KX, then the network.dns.answers.type UDM field is set to 36.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to CERT, then the network.dns.answers.type UDM field is set to 37.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to A6, then the network.dns.answers.type UDM field is set to 38.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to DNAME, then the network.dns.answers.type UDM field is set to 39.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to SINK, then the network.dns.answers.type UDM field is set to 40.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to OPT, then the network.dns.answers.type UDM field is set to 41.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to APL, then the network.dns.answers.type UDM field is set to 42.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to DS, then the network.dns.answers.type UDM field is set to 43.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to SSHFP, then the network.dns.answers.type UDM field is set to 44.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to IPSECKEY, then the network.dns.answers.type UDM field is set to 45.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to RRSIG, then the network.dns.answers.type UDM field is set to 46.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to NSEC, then the network.dns.answers.type UDM field is set to 47.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to DNSKEY, then the network.dns.answers.type UDM field is set to 48.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to DHCID, then the network.dns.answers.type UDM field is set to 49.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to NSEC3, then the network.dns.answers.type UDM field is set to 50.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to NSEC3PARAM, then the network.dns.answers.type UDM field is set to 51.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to TLSA, then the network.dns.answers.type UDM field is set to 52.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to SMIMEA, then the network.dns.answers.type UDM field is set to 53.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to UNASSIGNED, then the network.dns.answers.type UDM field is set to 54.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to HIP, then the network.dns.answers.type UDM field is set to 55.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to NINFO, then the network.dns.answers.type UDM field is set to 56.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to RKEY, then the network.dns.answers.type UDM field is set to 57.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to TALINK, then the network.dns.answers.type UDM field is set to 58.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to CDS, then the network.dns.answers.type UDM field is set to 59.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to CDNSKEY, then the network.dns.answers.type UDM field is set to 60.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to OPENPGPKEY, then the network.dns.answers.type UDM field is set to 61.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to CSYNC, then the network.dns.answers.type UDM field is set to 62.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to ZONEMD, then the network.dns.answers.type UDM field is set to 63.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to SVCB, then the network.dns.answers.type UDM field is set to 64.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to HTTPS, then the network.dns.answers.type UDM field is set to 65.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to SPF, then the network.dns.answers.type UDM field is set to 99.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to UINFO, then the network.dns.answers.type UDM field is set to 100.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to UID, then the network.dns.answers.type UDM field is set to 101.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to GID, then the network.dns.answers.type UDM field is set to 102.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to UNSPEC, then the network.dns.answers.type UDM field is set to 103.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to NID, then the network.dns.answers.type UDM field is set to 104.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to L32, then the network.dns.answers.type UDM field is set to 105.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to L64, then the network.dns.answers.type UDM field is set to 106.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to LP, then the network.dns.answers.type UDM field is set to 107.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to EUI48, then the network.dns.answers.type UDM field is set to 108.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to EUI64, then the network.dns.answers.type UDM field is set to 109.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to TKEY, then the network.dns.answers.type UDM field is set to 249.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to TSIG, then the network.dns.answers.type UDM field is set to 250.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to IXFR, then the network.dns.answers.type UDM field is set to 251.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to AXFR, then the network.dns.answers.type UDM field is set to 252.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to MAILB, then the network.dns.answers.type UDM field is set to 253.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to MAILA, then the network.dns.answers.type UDM field is set to 254.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to ALL, then the network.dns.answers.type UDM field is set to 255.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to URI, then the network.dns.answers.type UDM field is set to 256.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to CAA, then the network.dns.answers.type UDM field is set to 257.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to AVC, then the network.dns.answers.type UDM field is set to 258.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to DOA, then the network.dns.answers.type UDM field is set to 259.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to AMTRELAY, then the network.dns.answers.type UDM field is set to 260.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to TA, then the network.dns.answers.type UDM field is set to 32768.

Otherwise, if the properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is equal to DLV, then the network.dns.answers.type UDM field is set to 32769.
properties.AdditionalFields.DnsQueryResult.DnsQueryType additional.fields[DnsQueryType] Iterate through log field properties.AdditionalFields.DnsQueryResult:

The DnsQueryType_%{index} value is mapped to the additional.fields.key UDM field.

The properties.AdditionalFields.DnsQueryResult.DnsQueryType log field value is mapped to the additional.fields.value.string_value UDM field.

UDM 映射 Delta

UDM 映射增量参考信息：MICROSOFT DEFENDER ENDPOINT

下表列出了 Microsoft Defender Endpoint 的旧版 UDM 映射与 Microsoft Defender Endpoint 的新版 UDM 映射之间的差值。

UDM 映射增量参考信息：DeviceEvents 事件标识符到事件类型

下表列出了 DeviceEvents 日志操作类型的增量及其对应的 UDM 事件类型。

Event Identifier Old UDM Event Type Mapping New UDM Event Type Mapping
AntivirusDefinitionsUpdateFailed SCAN_HOST SETTING_MODIFICATION
AntivirusEmergencyUpdatesInstalled SCAN_HOST SETTING_MODIFICATION
AntivirusTroubleshootModeEvent SCAN_HOST STATUS_UPDATE
AppControlCodeIntegrityDriverRevoked SCAN_HOST SCAN_FILE
AppControlCodeIntegrityImageAudited SCAN_HOST SCAN_FILE
AppControlCodeIntegrityImageRevoked SCAN_HOST SCAN_FILE
AppControlCodeIntegrityOriginAllowed SCAN_HOST SCAN_FILE
AppControlCodeIntegrityOriginAudited SCAN_HOST SCAN_FILE
AppControlCodeIntegrityOriginBlocked SCAN_HOST SCAN_FILE
AppControlCodeIntegrityPolicyAudited SCAN_HOST SCAN_FILE
AppControlCodeIntegrityPolicyBlocked SCAN_HOST SCAN_FILE
AppControlCodeIntegrityPolicyLoaded SCAN_HOST SCAN_FILE
AppControlCodeIntegritySigningInformation SCAN_HOST GENERIC_EVENT
AppControlPolicyApplied SCAN_HOST SETTING_MODIFICATION
AppGuardBrowseToUrl SCAN_HOST NETWORK_UNCATEGORIZED
AppGuardCreateContainer SCAN_HOST PROCESS_LAUNCH
AppGuardLaunchedWithUrl SCAN_HOST PROCESS_LAUNCH
AppGuardResumeContainer SCAN_HOST PROCESS_UNCATEGORIZED
AppGuardStopContainer SCAN_HOST PROCESS_TERMINATION
AppGuardSuspendContainer SCAN_HOST PROCESS_UNCATEGORIZED
AppLockerBlockExecutable PROCESS_UNCATEGORIZED SCAN_HOST
AppLockerBlockPackagedApp STATUS_UPDATE SCAN_HOST
AppLockerBlockPackagedAppInstallation STATUS_UPDATE SCAN_HOST
AppLockerBlockScript STATUS_UPDATE SCAN_HOST
AuditPolicyModification SERVICE_MODIFICATION SETTING_MODIFICATION
BitLockerAuditCompleted SERVICE_UNSPECIFIED STATUS_UPDATE
BluetoothPolicyTriggered STATUS_UPDATE SCAN_HOST
ContainedDeviceConnectionBlocked NETWORK_UNCATEGORIZED NETWORK_CONNECTION
ControlFlowGuardViolation STATUS_UPDATE SCAN_HOST
DeviceBootAttestationInfo STATUS_UPDATE GENERIC_EVENT
DirectoryServiceObjectCreated SERVICE_MODIFICATION RESOURCE_CREATION
DirectoryServiceObjectModified SERVICE_MODIFICATION RESOURCE_WRITTEN
DpapiAccessed GENERIC_EVENT PROCESS_UNCATEGORIZED
GetAsyncKeyStateApiCall STATUS_UPDATE PROCESS_UNCATEGORIZED
GetClipboardData STATUS_UPDATE PROCESS_UNCATEGORIZED
LdapSearch STATUS_UPDATE RESOURCE_READ
NetworkShareObjectAccessChecked NETWORK_UNCATEGORIZED RESOURCE_READ
NetworkShareObjectAdded NETWORK_UNCATEGORIZED RESOURCE_CREATION
NetworkShareObjectDeleted NETWORK_UNCATEGORIZED RESOURCE_DELETION
NetworkShareObjectModified NETWORK_UNCATEGORIZED RESOURCE_WRITTEN
PnpDeviceAllowed DEVICE_CONFIG_UPDATE SCAN_HOST
PnpDeviceBlocked STATUS_UPDATE SCAN_HOST
PnpDeviceConnected STATUS_UPDATE DEVICE_CONFIG_UPDATE
PrintJobBlocked STATUS_UPDATE SCAN_UNCATEGORIZED
QueueUserApcRemoteApiCall PROCESS_LAUNCH PROCESS_UNCATEGORIZED
RemoteWmiOperation NETWORK_CONNECTION PROCESS_UNCATEGORIZED
RemovableStoragePolicyTriggered STATUS_UPDATE PROCESS_UNCATEGORIZED
SmartScreenAppWarning SCAN_UNCATEGORIZED SCAN_HOST
SmartScreenExploitWarning SCAN_UNCATEGORIZED SCAN_HOST
SmartScreenUrlWarning SCAN_UNCATEGORIZED SCAN_HOST
SmartScreenUserOverride SCAN_UNCATEGORIZED SETTING_MODIFICATION
WmiBindEventFilterToConsumer STATUS_UPDATE PROCESS_UNCATEGORIZED

UDM 映射增量参考信息：MICROSOFT DEFENDER ENDPOINT - DeviceEvents

下表列出了 DeviceEvents 日志类型的日志字段增量及其对应的 UDM 字段：

Raw Field Old UDM Mapping New UDM Mapping
properties.DeviceId principal.asset_id
principal.asset.asset_id		 If the properties.ActionType log field contains one of the following values, then DeviceID:%{properties.DeviceId} is mapped to the target.asset_id and target.asset.asset_id UDM field:
  • RemoteWmiOperation
  • ProcessCreatedUsingWmiQuery
Otherwise, DeviceID:%{properties.DeviceId} is mapped to the principal.asset_id and principal.asset.asset_id UDM fields.
properties.DeviceName principal.hostname
principal.asset.hostname		 If the properties.ActionType log field contains one of the following values, then the properties.DeviceName log field is mapped to the target.hostname and target.asset.hostname UDM field:
  • RemoteWmiOperation
  • ProcessCreatedUsingWmiQuery
Otherwise, the properties.DeviceName log field is mapped to the principal.hostname and principal.asset.hostname UDM fields.
properties.LocalIP principal.ip
principal.asset.ip		 If the properties.ActionType log field contains one of the following values, then the properties.LocalIP log field is mapped to the target.ip and target.asset.ip UDM field:
  • RemoteWmiOperation
  • ProcessCreatedUsingWmiQuery
Otherwise, the properties.LocalIP log field is mapped to the principal.ip and principal.asset.ip UDM fields.
properties.LocalPort principal.port If the properties.ActionType log field contains one of the following values, then the properties.LocalPort log field is mapped to the target.port UDM field:
  • RemoteWmiOperation
  • ProcessCreatedUsingWmiQuery
Otherwise, the properties.LocalPort log field is mapped to the principal.port UDM field.
properties.FolderPath target.file.full_path
target.process.file.full_path		 If the properties.ActionType log field contains one of the following values:
  • AmsiScriptDetection
  • AppGuardCreateContainer
  • AppGuardLaunchedWithUrl
  • AppGuardResumeContainer
  • AppGuardStopContainer
  • AppGuardSuspendContainer
  • ClrUnbackedModuleLoaded
  • CreateRemoteThreadApiCall
  • DpapiAccessed
  • DriverLoad
  • GetAsyncKeyStateApiCall
  • GetClipboardData
  • MemoryRemoteProtect
  • NamedPipeEvent
  • NtAllocateVirtualMemoryApiCall
  • NtAllocateVirtualMemoryRemoteApiCall
  • NtMapViewOfSectionRemoteApiCall
  • NtProtectVirtualMemoryApiCall
  • OpenProcessApiCall
  • PowerShellCommand
  • ProcessCreatedUsingWmiQuery
  • ProcessPrimaryTokenModified
  • PTraceDetected
  • QueueUserApcRemoteApiCall
  • ReadProcessMemoryApiCall
  • RemoteWmiOperation
  • RemovableStoragePolicyTriggered
  • ScriptContent
  • SetThreadContextRemoteApiCall
  • WmiBindEventFilterToConsumer
  • WriteProcessMemoryApiCall
  • WriteToLsassProcessMemory
  • AsrAdobeReaderChildProcessAudited
  • AsrAdobeReaderChildProcessBlocked
  • AsrAdobeReaderChildProcessWarnBypassed
  • AsrOfficeChildProcessAudited
  • AsrOfficeChildProcessBlocked
  • AsrOfficeChildProcessWarnBypassed
  • AsrOfficeCommAppChildProcessAudited
  • AsrOfficeCommAppChildProcessBlocked
  • AsrOfficeCommAppChildProcessWarnBypassed
  • AsrOfficeProcessInjectionAudited
  • AsrOfficeProcessInjectionBlocked
  • AsrOfficeProcessInjectionWarnBypassed
  • AsrPsexecWmiChildProcessAudited
  • AsrPsexecWmiChildProcessBlocked
  • AsrPsexecWmiChildProcessWarnBypassed
  • AsrUntrustedUsbProcessAudited
  • AsrUntrustedUsbProcessBlocked
  • AsrUntrustedUsbProcessWarnBypassed
  • ExploitGuardChildProcessAudited
  • ExploitGuardChildProcessBlocked
then if the properties.FolderPath log field value matches the regular expression pattern the properties.FileName log field value , then properties.FolderPath log field is mapped to the target.process.file.full_path UDM field, else %{properties.FolderPath}\%{properties.FileName} is mapped to the target.process.file.full_path UDM field.
Otherwise, if the properties.FolderPath log field value matches the regular expression pattern the properties.FileName log field value , then properties.FolderPath log field is mapped to the target.file.full_path UDM field, else %{properties.FolderPath}\%{properties.FileName} is mapped to the target.file.full_path UDM field.
properties.MD5 target.file.md5
target.process.file.md5		 If the properties.ActionType log field contains one of the following values:
  • AmsiScriptDetection
  • AppGuardCreateContainer
  • AppGuardLaunchedWithUrl
  • AppGuardResumeContainer
  • AppGuardStopContainer
  • AppGuardSuspendContainer
  • ClrUnbackedModuleLoaded
  • CreateRemoteThreadApiCall
  • DpapiAccessed
  • DriverLoad
  • GetAsyncKeyStateApiCall
  • GetClipboardData
  • MemoryRemoteProtect
  • NamedPipeEvent
  • NtAllocateVirtualMemoryApiCall
  • NtAllocateVirtualMemoryRemoteApiCall
  • NtMapViewOfSectionRemoteApiCall
  • NtProtectVirtualMemoryApiCall
  • OpenProcessApiCall
  • PowerShellCommand
  • ProcessCreatedUsingWmiQuery
  • ProcessPrimaryTokenModified
  • PTraceDetected
  • QueueUserApcRemoteApiCall
  • ReadProcessMemoryApiCall
  • RemoteWmiOperation
  • RemovableStoragePolicyTriggered
  • ScriptContent
  • SetThreadContextRemoteApiCall
  • WmiBindEventFilterToConsumer
  • WriteProcessMemoryApiCall
  • WriteToLsassProcessMemory
  • AsrAdobeReaderChildProcessAudited
  • AsrAdobeReaderChildProcessBlocked
  • AsrAdobeReaderChildProcessWarnBypassed
  • AsrOfficeChildProcessAudited
  • AsrOfficeChildProcessBlocked
  • AsrOfficeChildProcessWarnBypassed
  • AsrOfficeCommAppChildProcessAudited
  • AsrOfficeCommAppChildProcessBlocked
  • AsrOfficeCommAppChildProcessWarnBypassed
  • AsrOfficeProcessInjectionAudited
  • AsrOfficeProcessInjectionBlocked
  • AsrOfficeProcessInjectionWarnBypassed
  • AsrPsexecWmiChildProcessAudited
  • AsrPsexecWmiChildProcessBlocked
  • AsrPsexecWmiChildProcessWarnBypassed
  • AsrUntrustedUsbProcessAudited
  • AsrUntrustedUsbProcessBlocked
  • AsrUntrustedUsbProcessWarnBypassed
  • ExploitGuardChildProcessAudited
  • ExploitGuardChildProcessBlocked
and if the properties.MD5 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.MD5 log field is mapped to the target.process.file.md5 UDM field.
Otherwise, if the properties.MD5 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.MD5 log field is mapped to the target.file.md5 UDM field.
properties.FileName target.file.names
target.process.file.names		 If the properties.ActionType log field contains one of the following values:
  • AmsiScriptDetection
  • AppGuardCreateContainer
  • AppGuardLaunchedWithUrl
  • AppGuardResumeContainer
  • AppGuardStopContainer
  • AppGuardSuspendContainer
  • ClrUnbackedModuleLoaded
  • CreateRemoteThreadApiCall
  • DpapiAccessed
  • DriverLoad
  • GetAsyncKeyStateApiCall
  • GetClipboardData
  • MemoryRemoteProtect
  • NamedPipeEvent
  • NtAllocateVirtualMemoryApiCall
  • NtAllocateVirtualMemoryRemoteApiCall
  • NtMapViewOfSectionRemoteApiCall
  • NtProtectVirtualMemoryApiCall
  • OpenProcessApiCall
  • PowerShellCommand
  • ProcessCreatedUsingWmiQuery
  • ProcessPrimaryTokenModified
  • PTraceDetected
  • QueueUserApcRemoteApiCall
  • ReadProcessMemoryApiCall
  • RemoteWmiOperation
  • RemovableStoragePolicyTriggered
  • ScriptContent
  • SetThreadContextRemoteApiCall
  • WmiBindEventFilterToConsumer
  • WriteProcessMemoryApiCall
  • WriteToLsassProcessMemory
  • AsrAdobeReaderChildProcessAudited
  • AsrAdobeReaderChildProcessBlocked
  • AsrAdobeReaderChildProcessWarnBypassed
  • AsrOfficeChildProcessAudited
  • AsrOfficeChildProcessBlocked
  • AsrOfficeChildProcessWarnBypassed
  • AsrOfficeCommAppChildProcessAudited
  • AsrOfficeCommAppChildProcessBlocked
  • AsrOfficeCommAppChildProcessWarnBypassed
  • AsrOfficeProcessInjectionAudited
  • AsrOfficeProcessInjectionBlocked
  • AsrOfficeProcessInjectionWarnBypassed
  • AsrPsexecWmiChildProcessAudited
  • AsrPsexecWmiChildProcessBlocked
  • AsrPsexecWmiChildProcessWarnBypassed
  • AsrUntrustedUsbProcessAudited
  • AsrUntrustedUsbProcessBlocked
  • AsrUntrustedUsbProcessWarnBypassed
  • ExploitGuardChildProcessAudited
  • ExploitGuardChildProcessBlocked
then properties.FileName log field is mapped to the target.process.file.names UDM field.
Otherwise, properties.FileName log field is mapped to the target.file.names UDM field.
properties.SHA1 target.file.sha1
target.process.file.sha1		 If the properties.ActionType log field contains one of the following values:
  • AmsiScriptDetection
  • AppGuardCreateContainer
  • AppGuardLaunchedWithUrl
  • AppGuardResumeContainer
  • AppGuardStopContainer
  • AppGuardSuspendContainer
  • ClrUnbackedModuleLoaded
  • CreateRemoteThreadApiCall
  • DpapiAccessed
  • DriverLoad
  • GetAsyncKeyStateApiCall
  • GetClipboardData
  • MemoryRemoteProtect
  • NamedPipeEvent
  • NtAllocateVirtualMemoryApiCall
  • NtAllocateVirtualMemoryRemoteApiCall
  • NtMapViewOfSectionRemoteApiCall
  • NtProtectVirtualMemoryApiCall
  • OpenProcessApiCall
  • PowerShellCommand
  • ProcessCreatedUsingWmiQuery
  • ProcessPrimaryTokenModified
  • PTraceDetected
  • QueueUserApcRemoteApiCall
  • ReadProcessMemoryApiCall
  • RemoteWmiOperation
  • RemovableStoragePolicyTriggered
  • ScriptContent
  • SetThreadContextRemoteApiCall
  • WmiBindEventFilterToConsumer
  • WriteProcessMemoryApiCall
  • WriteToLsassProcessMemory
  • AsrAdobeReaderChildProcessAudited
  • AsrAdobeReaderChildProcessBlocked
  • AsrAdobeReaderChildProcessWarnBypassed
  • AsrOfficeChildProcessAudited
  • AsrOfficeChildProcessBlocked
  • AsrOfficeChildProcessWarnBypassed
  • AsrOfficeCommAppChildProcessAudited
  • AsrOfficeCommAppChildProcessBlocked
  • AsrOfficeCommAppChildProcessWarnBypassed
  • AsrOfficeProcessInjectionAudited
  • AsrOfficeProcessInjectionBlocked
  • AsrOfficeProcessInjectionWarnBypassed
  • AsrPsexecWmiChildProcessAudited
  • AsrPsexecWmiChildProcessBlocked
  • AsrPsexecWmiChildProcessWarnBypassed
  • AsrUntrustedUsbProcessAudited
  • AsrUntrustedUsbProcessBlocked
  • AsrUntrustedUsbProcessWarnBypassed
  • ExploitGuardChildProcessAudited
  • ExploitGuardChildProcessBlocked
and if the properties.SHA1 log field value matches the regular expression pattern ^[0-9a-f]+$, then properties.SHA1 log field is mapped to the target.process.file.sha1 UDM field.
Otherwise, if the properties.SHA1 log field value matches the regular expression pattern ^[0-9a-f]+$, then properties.SHA1 log field is mapped to the target.file.sha1 UDM field.
properties.SHA256 target.file.sha256
target.process.file.sha256		 If the properties.ActionType log field contains one of the following values:
  • AmsiScriptDetection
  • AppGuardCreateContainer
  • AppGuardLaunchedWithUrl
  • AppGuardResumeContainer
  • AppGuardStopContainer
  • AppGuardSuspendContainer
  • ClrUnbackedModuleLoaded
  • CreateRemoteThreadApiCall
  • DpapiAccessed
  • DriverLoad
  • GetAsyncKeyStateApiCall
  • GetClipboardData
  • MemoryRemoteProtect
  • NamedPipeEvent
  • NtAllocateVirtualMemoryApiCall
  • NtAllocateVirtualMemoryRemoteApiCall
  • NtMapViewOfSectionRemoteApiCall
  • NtProtectVirtualMemoryApiCall
  • OpenProcessApiCall
  • PowerShellCommand
  • ProcessCreatedUsingWmiQuery
  • ProcessPrimaryTokenModified
  • PTraceDetected
  • QueueUserApcRemoteApiCall
  • ReadProcessMemoryApiCall
  • RemoteWmiOperation
  • RemovableStoragePolicyTriggered
  • ScriptContent
  • SetThreadContextRemoteApiCall
  • WmiBindEventFilterToConsumer
  • WriteProcessMemoryApiCall
  • WriteToLsassProcessMemory
  • AsrAdobeReaderChildProcessAudited
  • AsrAdobeReaderChildProcessBlocked
  • AsrAdobeReaderChildProcessWarnBypassed
  • AsrOfficeChildProcessAudited
  • AsrOfficeChildProcessBlocked
  • AsrOfficeChildProcessWarnBypassed
  • AsrOfficeCommAppChildProcessAudited
  • AsrOfficeCommAppChildProcessBlocked
  • AsrOfficeCommAppChildProcessWarnBypassed
  • AsrOfficeProcessInjectionAudited
  • AsrOfficeProcessInjectionBlocked
  • AsrOfficeProcessInjectionWarnBypassed
  • AsrPsexecWmiChildProcessAudited
  • AsrPsexecWmiChildProcessBlocked
  • AsrPsexecWmiChildProcessWarnBypassed
  • AsrUntrustedUsbProcessAudited
  • AsrUntrustedUsbProcessBlocked
  • AsrUntrustedUsbProcessWarnBypassed
  • ExploitGuardChildProcessAudited
  • ExploitGuardChildProcessBlocked
and if the properties.SHA256 log field value matches the regular expression pattern ^[a-f0-9]{64}$, then properties.SHA256 log field is mapped to the target.process.file.sha256 UDM field.
Otherwise, if the properties.SHA256 log field value matches the regular expression pattern ^[a-f0-9]{64}$, then properties.SHA256 log field is mapped to the target.file.sha256 UDM field.
properties.FileSize target.file.size
target.process.file.size		 If the properties.ActionType log field contains one of the following values:
  • AmsiScriptDetection
  • AppGuardCreateContainer
  • AppGuardLaunchedWithUrl
  • AppGuardResumeContainer
  • AppGuardStopContainer
  • AppGuardSuspendContainer
  • ClrUnbackedModuleLoaded
  • CreateRemoteThreadApiCall
  • DpapiAccessed
  • DriverLoad
  • GetAsyncKeyStateApiCall
  • GetClipboardData
  • MemoryRemoteProtect
  • NamedPipeEvent
  • NtAllocateVirtualMemoryApiCall
  • NtAllocateVirtualMemoryRemoteApiCall
  • NtMapViewOfSectionRemoteApiCall
  • NtProtectVirtualMemoryApiCall
  • OpenProcessApiCall
  • PowerShellCommand
  • ProcessCreatedUsingWmiQuery
  • ProcessPrimaryTokenModified
  • PTraceDetected
  • QueueUserApcRemoteApiCall
  • ReadProcessMemoryApiCall
  • RemoteWmiOperation
  • RemovableStoragePolicyTriggered
  • ScriptContent
  • SetThreadContextRemoteApiCall
  • WmiBindEventFilterToConsumer
  • WriteProcessMemoryApiCall
  • WriteToLsassProcessMemory
  • AsrAdobeReaderChildProcessAudited
  • AsrAdobeReaderChildProcessBlocked
  • AsrAdobeReaderChildProcessWarnBypassed
  • AsrOfficeChildProcessAudited
  • AsrOfficeChildProcessBlocked
  • AsrOfficeChildProcessWarnBypassed
  • AsrOfficeCommAppChildProcessAudited
  • AsrOfficeCommAppChildProcessBlocked
  • AsrOfficeCommAppChildProcessWarnBypassed
  • AsrOfficeProcessInjectionAudited
  • AsrOfficeProcessInjectionBlocked
  • AsrOfficeProcessInjectionWarnBypassed
  • AsrPsexecWmiChildProcessAudited
  • AsrPsexecWmiChildProcessBlocked
  • AsrPsexecWmiChildProcessWarnBypassed
  • AsrUntrustedUsbProcessAudited
  • AsrUntrustedUsbProcessBlocked
  • AsrUntrustedUsbProcessWarnBypassed
  • ExploitGuardChildProcessAudited
  • ExploitGuardChildProcessBlocked
then properties.FileSize log field is mapped to the target.process.file.size UDM field.
Otherwise, properties.FileSize log field is mapped to the target.file.size UDM field.
properties.RemoteDeviceName principal.hostname
principal.asset.hostname		 If the properties.ActionType log field contains one of the following values, then the properties.RemoteDeviceName log field is mapped to the principal.hostname and principal.asset.hostname UDM field:
  • RemoteWmiOperation
  • ProcessCreatedUsingWmiQuery
Otherwise, the properties.RemoteDeviceName log field is mapped to the target.hostname and target.asset.hostname UDM fields.
properties.RemoteIP principal.ip
principal.asset.ip		 If the properties.ActionType log field contains one of the following values, then the properties.RemoteIP log field is mapped to the principal.ip and principal.asset.ip UDM field:
  • RemoteWmiOperation
  • ProcessCreatedUsingWmiQuery
Otherwise, the properties.RemoteIP log field is mapped to the target.ip and target.asset.ip UDM fields.
properties.RemotePort principal.port If the properties.ActionType log field contains one of the following values, then the properties.RemotePort log field is mapped to the principal.port UDM field:
  • RemoteWmiOperation
  • ProcessCreatedUsingWmiQuery
Otherwise, the properties.RemotePort log field is mapped to the target.port UDM field.
properties.RemoteUrl principal.url If the properties.ActionType log field contains one of the following values, then the properties.RemoteUrl log field is mapped to the principal.url UDM field:
  • RemoteWmiOperation
  • ProcessCreatedUsingWmiQuery
Otherwise, the properties.RemoteUrl log field is mapped to the target.url UDM field.

UDM 映射增量参考信息：MICROSOFT DEFENDER ENDPOINT - AlertEvidence

下表列出了 AlertEvidence 日志类型的日志字段增量及其对应的 UDM 字段：

Raw Field Old UDM Mapping New UDM Mapping
properties.Application additional.fields[application] principal.application
properties.EvidenceDirection principal.user.attribute.labels[evidence_direction] additional.fields[evidence_direction]
properties.EvidenceRole principal.user.attribute.labels[evidence_role] additional.fields[evidence_role]

UDM 映射增量参考信息：MICROSOFT DEFENDER ENDPOINT - AlertInfo

下表列出了 AlertInfo 日志类型的日志字段增量及其对应的 UDM 字段：

Raw Field Old UDM Mapping New UDM Mapping
properties.ServiceSource security_result.detection_fields[service_source] principal.application

UDM 映射增量参考信息：MICROSOFT DEFENDER ENDPOINT - DeviceFileCertificateInfo

下表列出了 DeviceFileCertificateInfo 日志类型的日志字段增量及其对应的 UDM 字段：

Raw Field Old UDM Mapping New UDM Mapping
properties.Timestamp metadata.event_timestamp metadata.creation_timestamp
The metadata.event_type UDM field is set to STATUS_UPDATE. The metadata.entity_type UDM field is set to FILE.
properties.ReportId metadata.product_log_id metadata.product_entity_id
properties.DeviceId principal.asset_id The entity.asset_id is set to DeviceID:%{properties.DeviceId}.
properties.SHA1 principal.file.sha1 If the properties.SHA1 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.SHA1 log field is mapped to the entity.file.sha1 UDM field.
properties.Issuer principal.file.signature_info.sigcheck.signers.cert_issuer entity.file.signature_info.sigcheck.signers.cert_issuer
properties.Signer principal.file.signature_info.sigcheck.signers.name entity.file.signature_info.sigcheck.signers.name
properties.IsSigned principal.file.signature_info.sigcheck.verified If the properties.IsSigned log field value is equal to true, then the entity.file.signature_info.sigcheck.verified UDM field is set to TRUE.
Otherwise, the entity.file.signature_info.sigcheck.verified UDM field is set to FALSE.
properties.DeviceName principal.hostname entity.asset.hostname
properties.CertificateSerialNumber additional.fields[certificate_serial_number] entity.file.signature_info.sigcheck.x509.serial_number

UDM 映射增量参考信息：MICROSOFT DEFENDER ENDPOINT - DeviceFileEvents

下表列出了 DeviceFileEvents 日志类型的日志字段增量及其对应的 UDM 字段：

Raw Field Old UDM Mapping New UDM Mapping
properties.FileOriginIP principal.ip src.ip
properties.RequestSourceIP principal.ip src.ip
properties.RequestSourcePort principal.port src.port
properties.FileOriginUrl principal.url src.url

UDM 映射增量参考信息：MICROSOFT DEFENDER ENDPOINT - DeviceLogonEvents

下表列出了 DeviceLogonEvents 日志类型的日志字段增量及其对应的 UDM 字段：

Raw Field Old UDM Mapping New UDM Mapping
properties.LogonId network.session_id extensions.auth.auth_details

UDM 映射增量参考信息：MICROSOFT DEFENDER ENDPOINT - DeviceTvmInfoGathering

下表列出了 DeviceTvmInfoGathering 日志类型的日志字段增量及其对应的 UDM 字段：

Raw Field Old UDM Mapping New UDM Mapping
properties.LastSeenTime security.result.last_discovered_time principal.asset.last_discover_time

UDM 映射增量参考信息：MICROSOFT DEFENDER ENDPOINT - DeviceRegistryEvents

下表列出了 DeviceRegistryEvents 日志类型的日志字段增量及其对应的 UDM 字段：

Raw Field Old UDM Mapping New UDM Mapping
properties.PreviousRegistryValueData principal.registry.registry_value_data src.registry.registry_value_data
properties.PreviousRegistryKey principal.registry.registry_key src.registry.registry_key
properties.PreviousRegistryValueName principal.registry.registry_value_name src.registry.registry_value_name

UDM 映射增量参考信息：MICROSOFT DEFENDER ENDPOINT - DeviceTvmSoftwareVulnerabilitiesKB

下表列出了 DeviceTvmSoftwareVulnerabilitiesKB 日志类型的日志字段增量及其对应的 UDM 字段：

Raw Field Old UDM Mapping New UDM Mapping
properties.IsExploitAvailable extensions.vulns.vulnerablities.cvss_vector additional.fields[is_exploit_available]
properties.LastModifiedTime extensions.vulns.vulnerabilities.scan_end_time additional.fields[last_modified_time]
properties.PublishedDate extensions.vulns.vulnerabilities.first_found additional.fields[published_date]
properties.AffectedSoftware extensions.vulns.vulnerabilities.description target.application

UDM 映射增量参考信息：MICROSOFT DEFENDER ENDPOINT - EmailEvents

下表列出了 EmailEvents 日志类型的日志字段增量及其对应的 UDM 字段：

Raw Field Old UDM Mapping New UDM Mapping
properties.SenderMailFromAddress principal.user.attribute.labels[sender_mail_from_address] network.email.reply_to
properties.DeliveryAction additional.fields[delivery_action] If the properties.DeliveryAction log field is equal to Delivered, then the security_result.action UDM field is set to ALLOW.
Otherwise, if the properties.DeliveryAction log field contains one of the following values:
  • Junked
  • Replaced
then the security_result.action UDM field is set to ALLOW_WITH_MODIFICATION.
Otherwise, if the properties.DeliveryAction log field is equal to Blocked, then the security_result.action UDM field is set to BLOCK.
Otherwise, the security_result.action UDM field is set to UNKNOWN_ACTION.

UDM 映射增量参考信息：MICROSOFT DEFENDER ENDPOINT - EmailPostDeliveryEvents

下表列出了 EmailPostDeliveryEvents 日志类型的日志字段增量及其对应的 UDM 字段：

Raw Field Old UDM Mapping New UDM Mapping
The metadata.event_type UDM field is set to EMAIL_UNCATEGORIZED. The metadata.event_type UDM field is set to EMAIL_TRANSACTION.

UDM 映射增量参考信息：MICROSOFT DEFENDER ENDPOINT - IdentityInfo

下表列出了 IdentityInfo 日志类型的日志字段增量及其对应的 UDM 字段：

Raw Field Old UDM Mapping New UDM Mapping
properties.Type entity.user.attribute.role.name If the properties.Type log field is equal to User, then the entity.user.account_type UDM field is set to DOMAIN_ACCOUNT_TYPE.
Otherwise, if the properties.Type log field is equal to ServiceAccount, then the entity.user.account_type UDM field is set to SERVICE_ACCOUNT_TYPE.
properties.Type entity.user.attribute.role.name entity.user.attribute.labels[type]

UDM 映射增量参考信息：MICROSOFT DEFENDER ENDPOINT - IdentityLogonEvents

下表列出了 IdentityLogonEvents 日志类型的日志字段增量及其对应的 UDM 字段：

Raw Field Old UDM Mapping New UDM Mapping
properties.Application additional.fields[application] principal.application
properties.AccountObjectId additional.fields[account_object_id] principal.user.product_object_id
properties.DestinationDeviceName src.hostname intermediary.hostname
properties.DestinationPort src.port intermediary.port
properties.DestinationIPAddress src.ip intermediary.ip
properties.AccountUpn principal.user.user_display_name principal.user.email_addresses

后续步骤

更新日志

查看相应解析器的更改日志

需要更多帮助？获得社区成员和 Google SecOps 专业人士的解答。