엔드포인트용 Microsoft Defender 로그 수집

다음에서 지원:

이 문서에서는 Google Security Operations 피드를 설정하여 Microsoft Defender for Endpoint 로그를 수집하는 방법과 로그 필드가 Google SecOps 통합 데이터 모델 (UDM) 필드에 매핑되는 방식을 설명합니다.

자세한 내용은 Google SecOps에 데이터 수집을 참조하세요.

일반적인 배포는 Microsoft Defender for Endpoint와 Google SecOps에 로그를 전송하도록 구성된 Google SecOps 피드로 구성됩니다. 배포는 이 문서에 설명된 일반적인 배포와 다를 수 있습니다. 배포에는 다음 구성요소가 포함됩니다.

  • 엔드포인트용 Microsoft Defender: 로그를 수집하는 플랫폼입니다.

  • Azure Storage: 로그를 저장하는 플랫폼입니다.

  • Google SecOps 피드: Microsoft Defender for Endpoint에서 로그를 가져오고 로그를 Google SecOps에 작성하는 Google SecOps 피드입니다.

  • Google SecOps: Microsoft Defender for Endpoint의 로그를 보관하고 분석하는 플랫폼입니다.

수집 라벨은 원시 로그 데이터를 구조화된 UDM 형식으로 정규화하는 파서를 식별합니다. 이 문서의 정보는 MICROSOFT_DEFENDER_ENDPOINT 수집 라벨이 있는 파서에 적용됩니다.

시작하기 전에

다음 기본 요건이 충족되었는지 확인합니다.

Azure 스토리지 계정 구성

이 섹션에서는 Microsoft Azure에서 Azure Storage 계정을 구성하고 배포하는 방법을 설명합니다.

스토리지 계정 만들기

시작하기 전에 리소스 그룹이 Azure 환경에 성공적으로 배포되었는지 확인하세요.

  1. Azure 포털에서 스토리지 계정을 검색합니다.
  2. 만들기를 클릭합니다.

  3. 기본 탭에서 다음 구성 세부정보를 제공합니다.

    설정 값
    구독 Azure 구독을 선택합니다.
    리소스 그룹 배포된 리소스 그룹을 선택합니다.
    스토리지 계정 이름 소문자와 숫자만 사용하여 3~24자 길이의 전역적으로 고유한 이름을 입력합니다.
    리전 사용자 또는 워크로드와 가장 가까운 리전을 선택합니다.
    기본 서비스 Azure Blob Storage 또는 Azure Data Lake Storage Gen2와 같은 기본 서비스를 선택합니다.
    성능 표준 (대부분의 시나리오에 권장) 또는 프리미엄 (지연 시간이 짧은 워크로드용)을 선택합니다.
    중복성 가용성 요구사항 (예: 로컬 중복 스토리지 (LRS))에 따라 복제 옵션을 선택합니다.

  4. 검토 + 만들기를 클릭합니다.

  5. 검증이 통과되면 만들기를 클릭하여 스토리지 계정을 배포합니다.

엔드포인트용 Microsoft Defender 설정

  1. 전역 관리자 또는 보안 관리자로 security.microsoft.com에 로그인합니다.
  2. 왼쪽 창에서 설정을 클릭합니다.
  3. Microsoft Defender XDR 탭을 선택합니다.
  4. 일반 섹션에서 Streaming API를 선택하고 추가를 클릭합니다.
  5. Azure Storage에 이벤트 전달을 선택합니다.
  6. 원하는 스토리지 계정으로 이동합니다.
  7. 개요 > JSON 보기를 선택하고 리소스 ID를 입력합니다.
  8. 리소스 ID를 입력한 후 필요한 데이터 유형을 모두 선택합니다.
  9. 저장을 클릭합니다.

피드 설정

Google SecOps 플랫폼에서 피드를 설정하는 방법은 두 가지입니다.

  • SIEM 설정 > 피드 > 새 피드 추가
  • 콘텐츠 허브 > 콘텐츠 팩 > 시작하기

엔드포인트용 Microsoft Defender 피드를 설정하는 방법

  1. Microsoft Defender 팩을 클릭합니다.
  2. Microsoft Defender for Endpoint 로그 유형을 찾습니다.

  3. 다음 필드에 값을 지정합니다.

    • 소스 유형: Microsoft Azure Blob Storage V2
    • Azure URI: Azure Blob Storage blob 또는 컨테이너를 가리키는 URI입니다.
    • 소스 삭제 옵션: 전송 후 파일이나 디렉터리를 삭제할지 여부입니다.
    • 최대 파일 기간: 지난 일수 동안 수정된 파일을 포함합니다. 기본값은 180일입니다.
    • 공유 키 또는 SAS 토큰을 선택합니다.
    • 키: Azure 리소스에 액세스하는 데 사용되는 공유 키 또는 SAS 토큰입니다.

    고급 옵션

    • 피드 이름: 피드를 식별하는 미리 입력된 값입니다.
    • 애셋 네임스페이스: 피드와 연결된 네임스페이스입니다.
    • 수집 라벨: 이 피드의 모든 이벤트에 적용되는 라벨입니다.

  4. 피드 만들기를 클릭합니다.

이 제품군 내에서 다양한 로그 유형에 대해 여러 피드를 구성하는 방법에 관한 자세한 내용은 제품별 피드 구성을 참고하세요.

지원되는 엔드포인트용 Microsoft Defender 로그 유형

Microsoft Defender for Endpoint 파서는 다음 표를 지원합니다.

  • AlertEvidence
  • AlertInfo
  • CloudAppEvents
  • DeviceAlertEvents
  • DeviceEvents
  • DeviceFileCertificateInfo
  • DeviceFileEvents
  • IdentityLogonEvents
  • DeviceImageLoadEvents
  • DeviceInfo
  • DeviceLogonEvents
  • DeviceNetworkEvents
  • DeviceNetworkInfo
  • DeviceProcessEvents
  • DeviceRegistryEvents
  • DeviceTvmInfoGathering
  • DeviceTvmInfoGatheringKB
  • DeviceTvmSecureConfigurationAssessment
  • DeviceTvmSecureConfigurationAssessmentKB
  • DeviceTvmSoftwareEvidenceBeta
  • DeviceTvmSoftwareInventory
  • DeviceTvmSoftwareVulnerabilities
  • DeviceTvmSoftwareVulnerabilitiesKB
  • EmailAttachmentInfo
  • EmailEvents
  • EmailPostDeliveryEvents
  • EmailUrlInfo
  • IdentityInfo

지원되는 엔드포인트용 Microsoft Defender 로그 형식

Microsoft Defender for Endpoint 파서는 JSON 형식의 로그를 지원합니다.

지원되는 엔드포인트용 Microsoft Defender 샘플 로그

  • JSON:

    {
  "time": "2021-07-16T09:57:38.1599837Z",
  "tenantId": "ed236696-8612-40d7-8b49-xxxxxxxxxxx",
  "operationName": "Publish",
  "category": "AdvancedHunting-DeviceInfo",
  "properties": {
    "OSBuild": null,
    "RegistryDeviceTag": null,
    "IsAzureADJoined": null,
    "PublicIP": "198.51.100.0",
    "OSArchitecture": null,
    "OSVersion": null,
    "OSPlatform": null,
    "LoggedOnUsers": "[{\\"UserName\\":\\"bob\\",\\"DomainName\\":\\"DESKTOP-BOB\\",\\"Sid\\":\\"S-1-5-21-1695909852-106810125-1651530144-1001\\"}]",
    "AdditionalFields": "{\\"IsLocalLogon\\":true}",
    "DeviceObjectId": null,
    "DeviceId": "e93c25ad74cc1dd30afeb642696a2559824589e5",
    "MachineGroup": null,
    "Timestamp": "2021-07-16T09:54:41.0662159Z",
    "DeviceName": "desktop-dummy",
    "ReportId": 193010,
    "ClientVersion": "10.7431.19041.746"
  }
}

필드 매핑 참조

이 섹션에서는 Google Security Operations 파서가 Microsoft Defender for Endpoint 필드를 Google Security Operations UDM 필드에 매핑하는 방법을 설명합니다.

필드 매핑 참조: MICROSOFT DEFENDER ENDPOINT - UDM 이벤트 모델의 공통 필드

다음 표에는 MICROSOFT_DEFENDER_ENDPOINT 로그 유형의 일반 로그 필드와 해당 UDM 필드가 나와 있습니다.

Common log field UDM mapping Logic
time metadata.collected_timestamp
category metadata.product_event_type
metadata.product_name The metadata.product_name UDM field is set to Microsoft Defender for Endpoint.
metadata.vendor_name The metadata.vendor_name UDM field is set to Microsoft.
Tenant observer.resource_ancestors.name
tenantId observer.resource_ancestors.product_object_id
operationName additional.fields[operation_name]
properties.ActionType security_result.summary

필드 매핑 참조: MICROSOFT DEFENDER ENDPOINT - UDM 엔티티 모델의 공통 필드

다음 표에는 MICROSOFT_DEFENDER_ENDPOINT 로그 유형의 일반 로그 필드와 해당 UDM 필드가 나와 있습니다.

Common log field UDM mapping Logic
metadata.vendor_name The metadata.vendor_name UDM field is set to Microsoft.
metadata.product_name The metadata.product_name UDM field is set to Microsoft Defender for Endpoint.
time metadata.collected_timestamp
tenantId relations.entity.resource.product_object_id
operationName additional.fields[operation_name]
category metadata.description
Tenant relations.entity.resource.name
relations.entity_type The relations.entity_type UDM field is set to RESOURCE.
relations.relationship The relations.relationship UDM field is set to MEMBER.
relations.direction The relations.direction UDM field is set to UNIDIRECTIONAL.

필드 매핑 참조: DeviceEvents 이벤트 식별자에서 이벤트 유형으로

다음 표에는 DeviceEvents 로그 작업 유형과 해당 UDM 이벤트 유형이 나와 있습니다.

Event Identifier Event Type
AntivirusDefinitionsUpdated SCAN_HOST
AntivirusDefinitionsUpdateFailed SETTING_MODIFICATION
AntivirusDetection SCAN_HOST
AntivirusDetectionActionType SCAN_HOST
AntivirusEmergencyUpdatesInstalled SETTING_MODIFICATION
AntivirusError SCAN_HOST
AntivirusMalwareActionFailed SCAN_HOST
AntivirusMalwareBlocked SCAN_HOST
AntivirusReport SCAN_HOST
AntivirusScanCancelled SCAN_HOST
AntivirusScanCompleted SCAN_HOST
AntivirusScanFailed SCAN_HOST
AntivirusTroubleshootModeEvent STATUS_UPDATE
AppControlAppInstallationAudited SCAN_HOST
AppControlAppInstallationBlocked SCAN_HOST
AppControlCIScriptAudited SCAN_HOST
AppControlCIScriptBlocked SCAN_HOST
AppControlCodeIntegrityDriverRevoked SCAN_FILE
AppControlCodeIntegrityImageAudited SCAN_FILE
AppControlCodeIntegrityImageRevoked SCAN_FILE
AppControlCodeIntegrityOriginAllowed SCAN_FILE
AppControlCodeIntegrityOriginAudited SCAN_FILE
AppControlCodeIntegrityOriginBlocked SCAN_FILE
AppControlCodeIntegrityPolicyAudited SCAN_FILE
AppControlCodeIntegrityPolicyBlocked SCAN_FILE
AppControlCodeIntegrityPolicyLoaded SCAN_FILE
AppControlCodeIntegritySigningInformation GENERIC_EVENT
AppControlExecutableAudited SCAN_HOST
AppControlExecutableBlocked SCAN_HOST
AppControlPackagedAppAudited SCAN_HOST
AppControlPackagedAppBlocked SCAN_HOST
AppControlPolicyApplied SETTING_MODIFICATION
AppControlScriptAudited SCAN_HOST
AppControlScriptBlocked SCAN_HOST
AppGuardBrowseToUrl NETWORK_UNCATEGORIZED
AppGuardCreateContainer PROCESS_LAUNCH
AppGuardLaunchedWithUrl PROCESS_LAUNCH
AppGuardResumeContainer PROCESS_UNCATEGORIZED
AppGuardStopContainer PROCESS_TERMINATION
AppGuardSuspendContainer PROCESS_UNCATEGORIZED
AppLockerBlockExecutable SCAN_HOST
AppLockerBlockPackagedApp SCAN_HOST
AppLockerBlockPackagedAppInstallation SCAN_HOST
AppLockerBlockScript SCAN_HOST
AsrAbusedSystemToolAudited SCAN_HOST
AsrAbusedSystemToolBlocked SCAN_HOST
AsrAbusedSystemToolWarnBypassed SCAN_HOST
AsrAdobeReaderChildProcessAudited SCAN_HOST
AsrAdobeReaderChildProcessBlocked SCAN_HOST
AsrAdobeReaderChildProcessWarnBypassed SCAN_HOST
AsrExecutableEmailContentAudited SCAN_HOST
AsrExecutableEmailContentBlocked SCAN_HOST
AsrExecutableEmailContentWarnBypassed SCAN_HOST
AsrExecutableOfficeContentAudited SCAN_HOST
AsrExecutableOfficeContentBlocked SCAN_HOST
AsrExecutableOfficeContentWarnBypassed SCAN_HOST
AsrLsassCredentialTheftAudited SCAN_HOST
AsrLsassCredentialTheftBlocked SCAN_HOST
AsrLsassCredentialTheftWarnBypassed SCAN_HOST
AsrObfuscatedScriptAudited SCAN_HOST
AsrObfuscatedScriptBlocked SCAN_HOST
AsrObfuscatedScriptWarnBypassed SCAN_HOST
AsrOfficeChildProcessAudited SCAN_HOST
AsrOfficeChildProcessBlocked SCAN_HOST
AsrOfficeChildProcessWarnBypassed SCAN_HOST
AsrOfficeCommAppChildProcessAudited SCAN_HOST
AsrOfficeCommAppChildProcessBlocked SCAN_HOST
AsrOfficeCommAppChildProcessWarnBypassed SCAN_HOST
AsrOfficeMacroWin32ApiCallsAudited SCAN_HOST
AsrOfficeMacroWin32ApiCallsBlocked SCAN_HOST
AsrOfficeMacroWin32ApiCallsWarnBypassed SCAN_HOST
AsrOfficeProcessInjectionAudited SCAN_HOST
AsrOfficeProcessInjectionBlocked SCAN_HOST
AsrOfficeProcessInjectionWarnBypassed SCAN_HOST
AsrPersistenceThroughWmiAudited SCAN_HOST
AsrPersistenceThroughWmiBlocked SCAN_HOST
AsrPersistenceThroughWmiWarnBypassed SCAN_HOST
AsrPsexecWmiChildProcessAudited SCAN_HOST
AsrPsexecWmiChildProcessBlocked SCAN_HOST
AsrPsexecWmiChildProcessWarnBypassed SCAN_HOST
AsrRansomwareAudited SCAN_HOST
AsrRansomwareBlocked SCAN_HOST
AsrRansomwareWarnBypassed SCAN_HOST
AsrSafeModeRebootAudited SCAN_HOST
AsrSafeModeRebootBlocked SCAN_HOST
AsrSafeModeRebootWarnBypassed SCAN_HOST
AsrScriptExecutableDownloadAudited SCAN_HOST
AsrScriptExecutableDownloadBlocked SCAN_HOST
AsrScriptExecutableDownloadWarnBypassed SCAN_HOST
AsrUntrustedExecutableAudited SCAN_HOST
AsrUntrustedExecutableBlocked SCAN_HOST
AsrUntrustedExecutableWarnBypassed SCAN_HOST
AsrUntrustedUsbProcessAudited SCAN_HOST
AsrUntrustedUsbProcessBlocked SCAN_HOST
AsrUntrustedUsbProcessWarnBypassed SCAN_HOST
AsrVulnerableSignedDriverAudited SCAN_HOST
AsrVulnerableSignedDriverBlocked SCAN_HOST
AsrVulnerableSignedDriverWarnBypassed SCAN_HOST
AsrWebShellOnServerAudited SCAN_HOST
AsrWebShellOnServerBlocked SCAN_HOST
AsrWebShellWarnBypassed SCAN_HOST
AuditPolicyModification SETTING_MODIFICATION
BitLockerAuditCompleted STATUS_UPDATE
BluetoothPolicyTriggered SCAN_HOST
BrowserLaunchedToOpenUrl NETWORK_UNCATEGORIZED
BruteForceActivityDetected USER_LOGIN
ClrUnbackedModuleLoaded PROCESS_MODULE_LOAD
ContainedDeviceConnectionBlocked NETWORK_CONNECTION
ControlFlowGuardViolation SCAN_HOST
ControlledFolderAccessViolationAudited SCAN_FILE
ControlledFolderAccessViolationBlocked SCAN_FILE
CreateRemoteThreadApiCall PROCESS_UNCATEGORIZED
CredentialsBackup SERVICE_START
DeviceBootAttestationInfo GENERIC_EVENT
DirectoryServiceObjectCreated RESOURCE_CREATION
DirectoryServiceObjectModified RESOURCE_WRITTEN
DlpPocPrintJob FILE_UNCATEGORIZED
DnsQueryRequest NETWORK_DNS
DnsQueryResponse NETWORK_DNS
DpapiAccessed PROCESS_UNCATEGORIZED
DriverLoad PROCESS_MODULE_LOAD
ExploitGuardAcgAudited SCAN_HOST
ExploitGuardAcgEnforced SCAN_HOST
ExploitGuardChildProcessAudited SCAN_HOST
ExploitGuardChildProcessBlocked SCAN_HOST
ExploitGuardEafViolationAudited SCAN_HOST
ExploitGuardEafViolationBlocked SCAN_HOST
ExploitGuardIafViolationAudited SCAN_HOST
ExploitGuardIafViolationBlocked SCAN_HOST
ExploitGuardLowIntegrityImageAudited SCAN_HOST
ExploitGuardLowIntegrityImageBlocked SCAN_HOST
ExploitGuardNetworkProtectionAudited SCAN_HOST
ExploitGuardNetworkProtectionBlocked SCAN_HOST
ExploitGuardNonMicrosoftSignedAudited SCAN_HOST
ExploitGuardNonMicrosoftSignedBlocked SCAN_HOST
ExploitGuardRopExploitAudited SCAN_HOST
ExploitGuardRopExploitBlocked SCAN_HOST
ExploitGuardSharedBinaryAudited SCAN_HOST
ExploitGuardSharedBinaryBlocked SCAN_HOST
ExploitGuardWin32SystemCallAudited SCAN_HOST
ExploitGuardWin32SystemCallBlocked SCAN_HOST
FileTimestampModificationEvent FILE_MODIFICATION
FirewallInboundConnectionBlocked NETWORK_CONNECTION
FirewallInboundConnectionToAppBlocked NETWORK_CONNECTION
FirewallOutboundConnectionBlocked NETWORK_CONNECTION
FirewallServiceStopped SERVICE_STOP
GetAsyncKeyStateApiCall PROCESS_UNCATEGORIZED
GetClipboardData PROCESS_UNCATEGORIZED
LdapSearch RESOURCE_READ
LogonRightsSettingEnabled USER_CHANGE_PERMISSIONS
MemoryRemoteProtect PROCESS_UNCATEGORIZED
NamedPipeEvent PROCESS_UNCATEGORIZED
NetworkProtectionUserBypassEvent NETWORK_UNCATEGORIZED
NetworkShareObjectAccessChecked RESOURCE_READ
NetworkShareObjectAdded RESOURCE_CREATION
NetworkShareObjectDeleted RESOURCE_DELETION
NetworkShareObjectModified RESOURCE_WRITTEN
NtAllocateVirtualMemoryApiCall PROCESS_UNCATEGORIZED
NtAllocateVirtualMemoryRemoteApiCall PROCESS_UNCATEGORIZED
NtMapViewOfSectionRemoteApiCall PROCESS_UNCATEGORIZED
NtProtectVirtualMemoryApiCall PROCESS_UNCATEGORIZED
OpenProcessApiCall PROCESS_OPEN
OtherAlertRelatedActivity STATUS_UPDATE
PasswordChangeAttempt USER_CHANGE_PASSWORD
PlistPropertyModified FILE_MODIFICATION
PnpDeviceAllowed SCAN_HOST
PnpDeviceBlocked SCAN_HOST
PnpDeviceConnected DEVICE_CONFIG_UPDATE
PowerShellCommand PROCESS_LAUNCH
PrintJobBlocked SCAN_UNCATEGORIZED
ProcessCreatedUsingWmiQuery PROCESS_LAUNCH
ProcessPrimaryTokenModified PROCESS_UNCATEGORIZED
PTraceDetected PROCESS_UNCATEGORIZED
QueueUserApcRemoteApiCall PROCESS_UNCATEGORIZED
ReadProcessMemoryApiCall PROCESS_UNCATEGORIZED
RemoteDesktopConnection NETWORK_CONNECTION
RemoteWmiOperation PROCESS_UNCATEGORIZED
RemovableStorageFileEvent FILE_UNCATEGORIZED
RemovableStoragePolicyTriggered PROCESS_UNCATEGORIZED
SafeDocFileScan SCAN_FILE
ScheduledTaskCreated SCHEDULED_TASK_CREATION
ScheduledTaskDeleted SCHEDULED_TASK_DELETION
ScheduledTaskDisabled SCHEDULED_TASK_DISABLE
ScheduledTaskEnabled SCHEDULED_TASK_ENABLE
ScheduledTaskUpdated SCHEDULED_TASK_MODIFICATION
ScreenshotTaken GENERIC_EVENT
ScriptContent PROCESS_LAUNCH
SecurityGroupCreated GROUP_CREATION
SecurityGroupDeleted GROUP_DELETION
SecurityLogCleared SYSTEM_AUDIT_LOG_WIPE
SensitiveFileRead FILE_READ
ServiceInstalled SERVICE_CREATION
SetThreadContextRemoteApiCall PROCESS_UNCATEGORIZED
ShellLinkCreateFileEvent FILE_CREATION
SmartScreenAppWarning SCAN_HOST
SmartScreenExploitWarning SCAN_HOST
SmartScreenUrlWarning SCAN_HOST
SmartScreenUserOverride SETTING_MODIFICATION
TamperingAttempt SETTING_MODIFICATION
TvmAxonTelemetryEvent STATUS_UPDATE
UntrustedWifiConnection NETWORK_CONNECTION
UsbDriveDriveLetterChanged DEVICE_CONFIG_UPDATE
UsbDriveMounted DEVICE_CONFIG_UPDATE
UsbDriveUnmounted DEVICE_CONFIG_UPDATE
UserAccountAddedToLocalGroup GROUP_MODIFICATION
UserAccountCreated USER_CREATION
UserAccountDeleted USER_DELETION
UserAccountModified USER_UNCATEGORIZED
UserAccountRemovedFromLocalGroup GROUP_MODIFICATION
WmiBindEventFilterToConsumer PROCESS_UNCATEGORIZED
WriteProcessMemoryApiCall PROCESS_UNCATEGORIZED
WriteToLsassProcessMemory PROCESS_UNCATEGORIZED
AccountCheckedForBlankPassword SCAN_UNCATEGORIZED
AmsiScriptDetection PROCESS_UNCATEGORIZED

필드 매핑 참조: MICROSOFT DEFENDER ENDPOINT - DeviceEvents

다음 표에는 DeviceEvents 로그 유형의 로그 필드와 해당 UDM 필드가 나와 있습니다.

Log field UDM mapping Logic
properties.Timestamp metadata.event_timestamp
properties.ActionType metadata.event_type
properties.ReportId metadata.product_log_id
properties.LogonId network.session_id
properties.InitiatingProcessSessionId additional.fields[initiating_process_session_id]
properties.IsInitiatingProcessRemoteSession additional.fields[is_initiating_process_remote_session]
properties.InitiatingProcessRemoteSessionIP src.ip
properties.InitiatingProcessRemoteSessionIP src.asset.ip
properties.ProcessRemoteSessionIP src.ip
properties.ProcessRemoteSessionIP src.asset.ip
properties.CreatedProcessSessionId additional.fields[created_process_session_id]
properties.IsProcessRemoteSession additional.fields[is_process_remote_session]
extensions.auth.mechanism The extensions.auth.mechanism UDM field is set to MECHANISM_UNSPECIFIED.
properties.InitiatingProcessRemoteSessionDeviceName src.hostname If properties.InitiatingProcessRemoteSessionDeviceName log field is not empty, then properties.InitiatingProcessRemoteSessionDeviceName log field is mapped to src.hostname UDM field.
properties.InitiatingProcessRemoteSessionDeviceName src.asset.hostname If properties.InitiatingProcessRemoteSessionDeviceName log field is not empty, then properties.InitiatingProcessRemoteSessionDeviceName log field is mapped to src.asset.hostname UDM field.
properties.ProcessRemoteSessionDeviceName src.hostname If properties.InitiatingProcessRemoteSessionDeviceName log field is empty, then properties.ProcessRemoteSessionDeviceName log field is mapped to src.hostname UDM field.
properties.ProcessRemoteSessionDeviceName src.asset.hostname If properties.InitiatingProcessRemoteSessionDeviceName log field is empty, then properties.ProcessRemoteSessionDeviceName log field is mapped to src.asset.hostname UDM field.
properties.ActionType network.application_protocol If the properties.ActionType log field contains one of the following values, then the network.application_protocol UDM field is set to DNS:
  • DnsQueryRequest
  • DnsQueryResponse
target.resource.resource_type If the properties.ActionType log field contains one of the following values:
  • AntivirusDefinitionsUpdateFailed
  • AntivirusEmergencyUpdatesInstalled
  • AppControlPolicyApplied
  • AuditPolicyModification
  • FirewallServiceStopped
  • SmartScreenUserOverride
  • TamperingAttempt
then the target.resource.resource_type UDM field is set to SETTING.
Else, if the properties.ActionType log field contains one of the following values:
  • ScheduledTaskCreated
  • ScheduledTaskDeleted
  • ScheduledTaskDisabled
  • ScheduledTaskEnabled
  • ScheduledTaskUpdated
then the target.resource.resource_type UDM field is set to TASK.
Else, if the properties.ActionType log field contains one of the following values:
  • DirectoryServiceObjectCreated
  • DirectoryServiceObjectModified
  • NetworkShareObjectAccessChecked
  • NetworkShareObjectAdded
  • NetworkShareObjectDeleted
  • NetworkShareObjectModified
then the target.resource.resource_type UDM field is set to STORAGE_OBJECT.
Else, if the properties.ActionType log field contains one of the following values:
  • ExploitGuardNetworkProtectionAudited
  • ExploitGuardNetworkProtectionBlocked
  • AsrOfficeProcessInjectionAudited
  • AsrExecutableEmailContentAudited
  • AsrExecutableOfficeContentAudited
  • AsrOfficeChildProcessAudited
  • AsrOfficeCommAppChildProcessAudited
  • AsrPsexecWmiChildProcessAudited
  • AsrScriptExecutableDownloadAudited
  • AsrUntrustedExecutableAudited
  • AsrUntrustedUsbProcessAudited
  • AsrWebShellOnServerAudited
  • ExploitGuardChildProcessAudited
  • ExploitGuardLowIntegrityImageAudited
  • ExploitGuardNonMicrosoftSignedAudited
  • ExploitGuardSharedBinaryAudited
  • AppControlCIScriptBlocked
  • AppControlExecutableBlocked
  • AppControlPackagedAppBlocked
  • AppControlScriptBlocked
  • AppLockerBlockExecutable
  • AppLockerBlockPackagedApp
  • AppLockerBlockPackagedAppInstallation
  • AppLockerBlockScript
  • AsrAbusedSystemToolBlocked
  • AsrAdobeReaderChildProcessBlocked
  • AsrExecutableEmailContentBlocked
  • AsrExecutableOfficeContentBlocked
  • AsrLsassCredentialTheftBlocked
  • AsrObfuscatedScriptBlocked
  • AsrOfficeChildProcessBlocked
  • AsrOfficeCommAppChildProcessBlocked
  • AsrOfficeMacroWin32ApiCallsBlocked
  • AsrOfficeProcessInjectionBlocked
  • AsrPersistenceThroughWmiBlocked
  • AsrPsexecWmiChildProcessBlocked
  • AsrRansomwareBlocked
  • AsrSafeModeRebootBlocked
  • AsrScriptExecutableDownloadBlocked
  • AsrUntrustedExecutableBlocked
  • AsrUntrustedUsbProcessBlocked
  • AsrVulnerableSignedDriverBlocked
  • AsrWebShellOnServerBlocked
  • ControlFlowGuardViolation
  • ExploitGuardAcgEnforced
  • ExploitGuardChildProcessBlocked
  • ExploitGuardEafViolationBlocked
  • ExploitGuardIafViolationBlocked
  • ExploitGuardLowIntegrityImageBlocked
  • ExploitGuardNonMicrosoftSignedBlocked
  • ExploitGuardRopExploitBlocked
  • ExploitGuardSharedBinaryBlocked
  • ExploitGuardWin32SystemCallBlocked
  • AppControlAppInstallationBlocked
  • AppControlAppInstallationAudited
  • AppControlCIScriptAudited
  • AppControlExecutableAudited
  • AppControlPackagedAppAudited
  • AppControlScriptAudited
  • AsrAbusedSystemToolAudited
  • AsrAdobeReaderChildProcessAudited
  • AsrLsassCredentialTheftAudited
  • AsrObfuscatedScriptAudited
  • AsrOfficeMacroWin32ApiCallsAudited
  • AsrPersistenceThroughWmiAudited
  • AsrRansomwareAudited
  • AsrSafeModeRebootAudited
  • AsrVulnerableSignedDriverAudited
  • ExploitGuardEafViolationAudited
  • ExploitGuardIafViolationAudited
  • ExploitGuardRopExploitAudited
  • ExploitGuardWin32SystemCallAudited
  • ExploitGuardAcgAudited
  • PnpDeviceAllowed
  • PnpDeviceBlocked
  • AntivirusDetection
  • AntivirusDetectionActionType
  • AntivirusMalwareActionFailed
  • AntivirusMalwareBlocked
  • AntivirusReport
  • AntivirusScanCancelled
  • AntivirusScanCompleted
  • AntivirusScanFailed
  • SmartScreenAppWarning
  • SmartScreenExploitWarning
  • SmartScreenUrlWarning
  • AntivirusError
  • AntivirusDefinitionsUpdated
  • AsrAbusedSystemToolWarnBypassed
  • AsrAdobeReaderChildProcessWarnBypassed
  • AsrExecutableEmailContentWarnBypassed
  • AsrExecutableOfficeContentWarnBypassed
  • AsrLsassCredentialTheftWarnBypassed
  • AsrObfuscatedScriptWarnBypassed
  • AsrOfficeChildProcessWarnBypassed
  • AsrOfficeCommAppChildProcessWarnBypassed
  • AsrOfficeMacroWin32ApiCallsWarnBypassed
  • AsrOfficeProcessInjectionWarnBypassed
  • AsrPersistenceThroughWmiWarnBypassed
  • AsrPsexecWmiChildProcessWarnBypassed
  • AsrRansomwareWarnBypassed
  • AsrSafeModeRebootWarnBypassed
  • AsrScriptExecutableDownloadWarnBypassed
  • AsrUntrustedExecutableWarnBypassed
  • AsrUntrustedUsbProcessWarnBypassed
  • AsrVulnerableSignedDriverWarnBypassed
  • AsrWebShellWarnBypassed
  • BluetoothPolicyTriggered
  • PnpDeviceConnected
then the target.resource.resource_type UDM field is set to DEVICE.
properties.DeviceId principal.asset_id If the properties.ActionType log field contains one of the following values, then DeviceID:%{properties.DeviceId} is mapped to the target.asset_id and target.asset.asset_id UDM field:
  • RemoteWmiOperation
  • ProcessCreatedUsingWmiQuery
Else, DeviceID:%{properties.DeviceId} is mapped to the principal.asset_id and principal.asset.asset_id UDM fields.
properties.DeviceId principal.asset.asset_id If the properties.ActionType log field contains one of the following values, then DeviceID:%{properties.DeviceId} is mapped to the target.asset_id and target.asset.asset_id UDM field:
  • RemoteWmiOperation
  • ProcessCreatedUsingWmiQuery
Else, DeviceID:%{properties.DeviceId} is mapped to the principal.asset_id and principal.asset.asset_id UDM fields.
properties.DeviceId target.asset_id If the properties.ActionType log field contains one of the following values, then DeviceID:%{properties.DeviceId} is mapped to the target.asset_id and target.asset.asset_id UDM field:
  • RemoteWmiOperation
  • ProcessCreatedUsingWmiQuery
Else, DeviceID:%{properties.DeviceId} is mapped to the principal.asset_id and principal.asset.asset_id UDM fields.
properties.DeviceId target.asset.asset_id If the properties.ActionType log field contains one of the following values, then DeviceID:%{properties.DeviceId} is mapped to the target.asset_id and target.asset.asset_id UDM field:
  • RemoteWmiOperation
  • ProcessCreatedUsingWmiQuery
Else, DeviceID:%{properties.DeviceId} is mapped to the principal.asset_id and principal.asset.asset_id UDM fields.
properties.InitiatingProcessAccountDomain principal.administrative_domain If the properties.ActionType log field contains one of the following values and the properties.InitiatingProcessAccountDomain log field value is not empty, then the properties.InitiatingProcessAccountDomain log field is mapped to the target.administrative_domain UDM field:
  • RemoteWmiOperation
  • ProcessCreatedUsingWmiQuery
Else, if the properties.InitiatingProcessAccountDomain log field value is not empty, then the properties.InitiatingProcessAccountDomain log field is mapped to the principal.administrative_domain UDM field.
properties.InitiatingProcessAccountDomain target.administrative_domain If the properties.ActionType log field contains one of the following values and the properties.InitiatingProcessAccountDomain log field value is not empty, then the properties.InitiatingProcessAccountDomain log field is mapped to the target.administrative_domain UDM field:
  • RemoteWmiOperation
  • ProcessCreatedUsingWmiQuery
Else, if the properties.InitiatingProcessAccountDomain log field value is not empty, then the properties.InitiatingProcessAccountDomain log field is mapped to the principal.administrative_domain UDM field.
properties.AccountDomain principal.administrative_domain If the properties.ActionType log field contains one of the following values:
  • BruteForceActivityDetected
  • LogonRightsSettingEnabled
  • PasswordChangeAttempt
  • UserAccountCreated
  • UserAccountDeleted
  • UserAccountModified
then if the properties.AccountDomain log field is not empty, then it is mapped to the target.administrative_domain UDM field.

Else, if the properties.InitiatingProcessAccountDomain log field is not empty and the properties.AccountDomain log field is not empty, then the properties.AccountDomain log field is mapped to additional.fields[AccountDomain].

Else if the properties.InitiatingProcessAccountDomain log field is empty and the properties.AccountDomain log field is not empty, then the properties.AccountDomain log field is mapped to the principal.administrative_domain UDM field.
properties.AccountDomain target.administrative_domain If the properties.ActionType log field contains one of the following values:
  • BruteForceActivityDetected
  • LogonRightsSettingEnabled
  • PasswordChangeAttempt
  • UserAccountCreated
  • UserAccountDeleted
  • UserAccountModified
then if the properties.AccountDomain log field is not empty, then it is mapped to the target.administrative_domain UDM field.

Else, if the properties.InitiatingProcessAccountDomain log field is not empty and the properties.AccountDomain log field is not empty, then the properties.AccountDomain log field is mapped to additional.fields[AccountDomain].

Else if the properties.InitiatingProcessAccountDomain log field is empty and the properties.AccountDomain log field is not empty, then the properties.AccountDomain log field is mapped to the principal.administrative_domain UDM field.
properties.DeviceName principal.hostname If the properties.ActionType log field contains one of the following values, then the properties.DeviceName log field is mapped to the target.hostname and target.asset.hostname UDM field:
  • RemoteWmiOperation
  • ProcessCreatedUsingWmiQuery
Else, the properties.DeviceName log field is mapped to the principal.hostname and principal.asset.hostname UDM fields.
properties.DeviceName principal.asset.hostname If the properties.ActionType log field contains one of the following values, then the properties.DeviceName log field is mapped to the target.hostname and target.asset.hostname UDM field:
  • RemoteWmiOperation
  • ProcessCreatedUsingWmiQuery
Else, the properties.DeviceName log field is mapped to the principal.hostname and principal.asset.hostname UDM fields.
properties.DeviceName target.hostname If the properties.ActionType log field contains one of the following values, then the properties.DeviceName log field is mapped to the target.hostname and target.asset.hostname UDM field:
  • RemoteWmiOperation
  • ProcessCreatedUsingWmiQuery
Else, the properties.DeviceName log field is mapped to the principal.hostname and principal.asset.hostname UDM fields.
properties.DeviceName target.asset.hostname If the properties.ActionType log field contains one of the following values, then the properties.DeviceName log field is mapped to the target.hostname and target.asset.hostname UDM field:
  • RemoteWmiOperation
  • ProcessCreatedUsingWmiQuery
Else, the properties.DeviceName log field is mapped to the principal.hostname and principal.asset.hostname UDM fields.
properties.LocalIP principal.ip If the properties.ActionType log field contains one of the following values, then the properties.LocalIP log field is mapped to the target.ip and target.asset.ip UDM field:
  • RemoteWmiOperation
  • ProcessCreatedUsingWmiQuery
Else, the properties.LocalIP log field is mapped to the principal.ip and principal.asset.ip UDM fields.
properties.LocalIP principal.asset.ip If the properties.ActionType log field contains one of the following values, then the properties.LocalIP log field is mapped to the target.ip and target.asset.ip UDM field:
  • RemoteWmiOperation
  • ProcessCreatedUsingWmiQuery
Else, the properties.LocalIP log field is mapped to the principal.ip and principal.asset.ip UDM fields.
properties.LocalIP target.ip If the properties.ActionType log field contains one of the following values, then the properties.LocalIP log field is mapped to the target.ip and target.asset.ip UDM field:
  • RemoteWmiOperation
  • ProcessCreatedUsingWmiQuery
Else, the properties.LocalIP log field is mapped to the principal.ip and principal.asset.ip UDM fields.
properties.LocalIP target.asset.ip If the properties.ActionType log field contains one of the following values, then the properties.LocalIP log field is mapped to the target.ip and target.asset.ip UDM field:
  • RemoteWmiOperation
  • ProcessCreatedUsingWmiQuery
Else, the properties.LocalIP log field is mapped to the principal.ip and principal.asset.ip UDM fields.
properties.FileOriginIP principal.ip
properties.FileOriginIP principal.asset.ip
properties.LocalPort principal.port If the properties.ActionType log field contains one of the following values, then the properties.LocalPort log field is mapped to the target.port UDM field:
  • RemoteWmiOperation
  • ProcessCreatedUsingWmiQuery
Else, the properties.LocalPort log field is mapped to the principal.port UDM field.
properties.LocalPort target.port If the properties.ActionType log field contains one of the following values, then the properties.LocalPort log field is mapped to the target.port UDM field:
  • RemoteWmiOperation
  • ProcessCreatedUsingWmiQuery
Else, the properties.LocalPort log field is mapped to the principal.port UDM field.
properties.InitiatingProcessCommandLine principal.process.command_line
properties.InitiatingProcessFolderPath principal.process.file.full_path If the properties.InitiatingProcessFolderPath log field value matches the regular expression pattern the properties.InitiatingProcessFileName log field value, then the properties.InitiatingProcessFolderPath log field is mapped to the principal.process.file.full_path UDM field.

Else, the principal.process.file.full_path is set to %{properties.InitiatingProcessFolderPath}/%{properties.InitiatingProcessFileName}.
properties.InitiatingProcessMD5 principal.process.file.md5 If the properties.InitiatingProcessMD5 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.InitiatingProcessMD5 log field is mapped to the principal.process.file.md5 UDM field.
properties.InitiatingProcessFileName principal.process.file.names
properties.InitiatingProcessSHA1 principal.process.file.sha1 If the properties.InitiatingProcessSHA1 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.InitiatingProcessSHA1 log field is mapped to the principal.process.file.sha1 UDM field.
properties.InitiatingProcessSHA256 principal.process.file.sha256 If the properties.InitiatingProcessSHA256 log field value matches the regular expression pattern ^[a-f0-9]{64}$, then the properties.InitiatingProcessSHA256 log field is mapped to the principal.process.file.sha256 UDM field.
properties.InitiatingProcessFileSize principal.process.file.size
properties.InitiatingProcessParentFileName principal.process.parent_process.file.names
properties.InitiatingProcessParentId principal.process.parent_process.pid
properties.InitiatingProcessId principal.process.pid
properties.FileOriginUrl principal.url
properties.InitiatingProcessAccountObjectId principal.user.product_object_id
properties.InitiatingProcessAccountUpn principal.user.user_display_name
properties.InitiatingProcessAccountName principal.user.userid
properties.AccountName principal.user.userid If the properties.ActionType log field contains one of the following values:
  • BruteForceActivityDetected
  • LogonRightsSettingEnabled
  • PasswordChangeAttempt
  • UserAccountCreated
  • UserAccountDeleted
  • UserAccountModified
then if the properties.AccountName log field is not empty, then it is mapped to the target.user.userid UDM field.

Else, if the properties.InitiatingProcessAccountName log field is not empty and the properties.AccountName log field is not empty, then the properties.AccountName log field is mapped to additional.fields[AccountName].

Else if the properties.InitiatingProcessAccountName log field is empty and the properties.AccountName log field is not empty, then the properties.AccountName log field is mapped to the principal.user.userid UDM field.
properties.AccountName target.user.userid If the properties.ActionType log field contains one of the following values:
  • BruteForceActivityDetected
  • LogonRightsSettingEnabled
  • PasswordChangeAttempt
  • UserAccountCreated
  • UserAccountDeleted
  • UserAccountModified
then if the properties.AccountName log field is not empty, then it is mapped to the target.user.userid UDM field.

Else, if the properties.InitiatingProcessAccountName log field is not empty and the properties.AccountName log field is not empty, then the properties.AccountName log field is mapped to additional.fields[AccountName].

Else if the properties.InitiatingProcessAccountName log field is empty and the properties.AccountName log field is not empty, then the properties.AccountName log field is mapped to the principal.user.userid UDM field.
properties.InitiatingProcessAccountSid principal.user.windows_sid
properties.AccountSid principal.user.windows_sid If the properties.ActionType log field contains one of the following values:
  • BruteForceActivityDetected
  • LogonRightsSettingEnabled
  • PasswordChangeAttempt
  • UserAccountCreated
  • UserAccountDeleted
  • UserAccountModified
then if the properties.AccountSid log field is not empty, then it is mapped to the target.user.windows_sid UDM field.

Else, if the properties.InitiatingProcessAccountSid log field is not empty and the properties.AccountSid log field is not empty, then the properties.AccountSid log field is mapped to additional.fields[AccountSid].

Else if the properties.InitiatingProcessAccountSid log field is empty and the properties.AccountSid log field is not empty, then the properties.AccountSid log field is mapped to the principal.user.windows_sid UDM field.
properties.AccountSid target.user.windows_sid If the properties.ActionType log field contains one of the following values:
  • BruteForceActivityDetected
  • LogonRightsSettingEnabled
  • PasswordChangeAttempt
  • UserAccountCreated
  • UserAccountDeleted
  • UserAccountModified
then if the properties.AccountSid log field is not empty, then it is mapped to the target.user.windows_sid UDM field.

Else, if the properties.InitiatingProcessAccountSid log field is not empty and the properties.AccountSid log field is not empty, then the properties.AccountSid log field is mapped to additional.fields[AccountSid].

Else if the properties.InitiatingProcessAccountSid log field is empty and the properties.AccountSid log field is not empty, then the properties.AccountSid log field is mapped to the principal.user.windows_sid UDM field.
properties.ActionType security_result.action If the properties.ActionType log field value matches the regular expression pattern (?i)Allow, then the security_result.action UDM field is set to ALLOW.

Else if the properties.ActionType log field value matches the regular expression pattern (?i)Block, then the security_result.action UDM field is set to BLOCK.

Else if the properties.ActionType log field value matches the regular expression pattern (?i)Fail, then the security_result.action UDM field is set to FAIL.
properties.FolderPath target.file.full_path If the properties.ActionType log field contains one of the following values:
  • AmsiScriptDetection
  • AppGuardCreateContainer
  • AppGuardLaunchedWithUrl
  • AppGuardResumeContainer
  • AppGuardStopContainer
  • AppGuardSuspendContainer
  • ClrUnbackedModuleLoaded
  • CreateRemoteThreadApiCall
  • DpapiAccessed
  • DriverLoad
  • GetAsyncKeyStateApiCall
  • GetClipboardData
  • MemoryRemoteProtect
  • NamedPipeEvent
  • NtAllocateVirtualMemoryApiCall
  • NtAllocateVirtualMemoryRemoteApiCall
  • NtMapViewOfSectionRemoteApiCall
  • NtProtectVirtualMemoryApiCall
  • OpenProcessApiCall
  • PowerShellCommand
  • ProcessCreatedUsingWmiQuery
  • ProcessPrimaryTokenModified
  • PTraceDetected
  • QueueUserApcRemoteApiCall
  • ReadProcessMemoryApiCall
  • RemoteWmiOperation
  • RemovableStoragePolicyTriggered
  • ScriptContent
  • SetThreadContextRemoteApiCall
  • WmiBindEventFilterToConsumer
  • WriteProcessMemoryApiCall
  • WriteToLsassProcessMemory
  • AsrAdobeReaderChildProcessAudited
  • AsrAdobeReaderChildProcessBlocked
  • AsrAdobeReaderChildProcessWarnBypassed
  • AsrOfficeChildProcessAudited
  • AsrOfficeChildProcessBlocked
  • AsrOfficeChildProcessWarnBypassed
  • AsrOfficeCommAppChildProcessAudited
  • AsrOfficeCommAppChildProcessBlocked
  • AsrOfficeCommAppChildProcessWarnBypassed
  • AsrOfficeProcessInjectionAudited
  • AsrOfficeProcessInjectionBlocked
  • AsrOfficeProcessInjectionWarnBypassed
  • AsrPsexecWmiChildProcessAudited
  • AsrPsexecWmiChildProcessBlocked
  • AsrPsexecWmiChildProcessWarnBypassed
  • AsrUntrustedUsbProcessAudited
  • AsrUntrustedUsbProcessBlocked
  • AsrUntrustedUsbProcessWarnBypassed
  • ExploitGuardChildProcessAudited
  • ExploitGuardChildProcessBlocked
then if the properties.FolderPath log field value matches the regular expression pattern the properties.FileName log field value , then properties.FolderPath log field is mapped to the target.process.file.full_path UDM field, else %{properties.FolderPath}\%{properties.FileName} is mapped to the target.process.file.full_path UDM field.
Else, if the properties.FolderPath log field value matches the regular expression pattern the properties.FileName log field value , then properties.FolderPath log field is mapped to the target.file.full_path UDM field, else %{properties.FolderPath}\%{properties.FileName} is mapped to the target.file.full_path UDM field.
properties.FolderPath target.process.file.full_path If the properties.ActionType log field contains one of the following values:
  • AmsiScriptDetection
  • AppGuardCreateContainer
  • AppGuardLaunchedWithUrl
  • AppGuardResumeContainer
  • AppGuardStopContainer
  • AppGuardSuspendContainer
  • ClrUnbackedModuleLoaded
  • CreateRemoteThreadApiCall
  • DpapiAccessed
  • DriverLoad
  • GetAsyncKeyStateApiCall
  • GetClipboardData
  • MemoryRemoteProtect
  • NamedPipeEvent
  • NtAllocateVirtualMemoryApiCall
  • NtAllocateVirtualMemoryRemoteApiCall
  • NtMapViewOfSectionRemoteApiCall
  • NtProtectVirtualMemoryApiCall
  • OpenProcessApiCall
  • PowerShellCommand
  • ProcessCreatedUsingWmiQuery
  • ProcessPrimaryTokenModified
  • PTraceDetected
  • QueueUserApcRemoteApiCall
  • ReadProcessMemoryApiCall
  • RemoteWmiOperation
  • RemovableStoragePolicyTriggered
  • ScriptContent
  • SetThreadContextRemoteApiCall
  • WmiBindEventFilterToConsumer
  • WriteProcessMemoryApiCall
  • WriteToLsassProcessMemory
  • AsrAdobeReaderChildProcessAudited
  • AsrAdobeReaderChildProcessBlocked
  • AsrAdobeReaderChildProcessWarnBypassed
  • AsrOfficeChildProcessAudited
  • AsrOfficeChildProcessBlocked
  • AsrOfficeChildProcessWarnBypassed
  • AsrOfficeCommAppChildProcessAudited
  • AsrOfficeCommAppChildProcessBlocked
  • AsrOfficeCommAppChildProcessWarnBypassed
  • AsrOfficeProcessInjectionAudited
  • AsrOfficeProcessInjectionBlocked
  • AsrOfficeProcessInjectionWarnBypassed
  • AsrPsexecWmiChildProcessAudited
  • AsrPsexecWmiChildProcessBlocked
  • AsrPsexecWmiChildProcessWarnBypassed
  • AsrUntrustedUsbProcessAudited
  • AsrUntrustedUsbProcessBlocked
  • AsrUntrustedUsbProcessWarnBypassed
  • ExploitGuardChildProcessAudited
  • ExploitGuardChildProcessBlocked
then if the properties.FolderPath log field value matches the regular expression pattern the properties.FileName log field value , then properties.FolderPath log field is mapped to the target.process.file.full_path UDM field, else %{properties.FolderPath}\%{properties.FileName} is mapped to the target.process.file.full_path UDM field.
Else, if the properties.FolderPath log field value matches the regular expression pattern the properties.FileName log field value , then properties.FolderPath log field is mapped to the target.file.full_path UDM field, else %{properties.FolderPath}\%{properties.FileName} is mapped to the target.file.full_path UDM field.
properties.MD5 target.file.md5 If the properties.ActionType log field contains one of the following values:
  • AmsiScriptDetection
  • AppGuardCreateContainer
  • AppGuardLaunchedWithUrl
  • AppGuardResumeContainer
  • AppGuardStopContainer
  • AppGuardSuspendContainer
  • ClrUnbackedModuleLoaded
  • CreateRemoteThreadApiCall
  • DpapiAccessed
  • DriverLoad
  • GetAsyncKeyStateApiCall
  • GetClipboardData
  • MemoryRemoteProtect
  • NamedPipeEvent
  • NtAllocateVirtualMemoryApiCall
  • NtAllocateVirtualMemoryRemoteApiCall
  • NtMapViewOfSectionRemoteApiCall
  • NtProtectVirtualMemoryApiCall
  • OpenProcessApiCall
  • PowerShellCommand
  • ProcessCreatedUsingWmiQuery
  • ProcessPrimaryTokenModified
  • PTraceDetected
  • QueueUserApcRemoteApiCall
  • ReadProcessMemoryApiCall
  • RemoteWmiOperation
  • RemovableStoragePolicyTriggered
  • ScriptContent
  • SetThreadContextRemoteApiCall
  • WmiBindEventFilterToConsumer
  • WriteProcessMemoryApiCall
  • WriteToLsassProcessMemory
  • AsrAdobeReaderChildProcessAudited
  • AsrAdobeReaderChildProcessBlocked
  • AsrAdobeReaderChildProcessWarnBypassed
  • AsrOfficeChildProcessAudited
  • AsrOfficeChildProcessBlocked
  • AsrOfficeChildProcessWarnBypassed
  • AsrOfficeCommAppChildProcessAudited
  • AsrOfficeCommAppChildProcessBlocked
  • AsrOfficeCommAppChildProcessWarnBypassed
  • AsrOfficeProcessInjectionAudited
  • AsrOfficeProcessInjectionBlocked
  • AsrOfficeProcessInjectionWarnBypassed
  • AsrPsexecWmiChildProcessAudited
  • AsrPsexecWmiChildProcessBlocked
  • AsrPsexecWmiChildProcessWarnBypassed
  • AsrUntrustedUsbProcessAudited
  • AsrUntrustedUsbProcessBlocked
  • AsrUntrustedUsbProcessWarnBypassed
  • ExploitGuardChildProcessAudited
  • ExploitGuardChildProcessBlocked
and if the properties.MD5 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.MD5 log field is mapped to the target.process.file.md5 UDM field.
Else, if the properties.MD5 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.MD5 log field is mapped to the target.file.md5 UDM field.
properties.MD5 target.process.file.md5 If the properties.ActionType log field contains one of the following values:
  • AmsiScriptDetection
  • AppGuardCreateContainer
  • AppGuardLaunchedWithUrl
  • AppGuardResumeContainer
  • AppGuardStopContainer
  • AppGuardSuspendContainer
  • ClrUnbackedModuleLoaded
  • CreateRemoteThreadApiCall
  • DpapiAccessed
  • DriverLoad
  • GetAsyncKeyStateApiCall
  • GetClipboardData
  • MemoryRemoteProtect
  • NamedPipeEvent
  • NtAllocateVirtualMemoryApiCall
  • NtAllocateVirtualMemoryRemoteApiCall
  • NtMapViewOfSectionRemoteApiCall
  • NtProtectVirtualMemoryApiCall
  • OpenProcessApiCall
  • PowerShellCommand
  • ProcessCreatedUsingWmiQuery
  • ProcessPrimaryTokenModified
  • PTraceDetected
  • QueueUserApcRemoteApiCall
  • ReadProcessMemoryApiCall
  • RemoteWmiOperation
  • RemovableStoragePolicyTriggered
  • ScriptContent
  • SetThreadContextRemoteApiCall
  • WmiBindEventFilterToConsumer
  • WriteProcessMemoryApiCall
  • WriteToLsassProcessMemory
  • AsrAdobeReaderChildProcessAudited
  • AsrAdobeReaderChildProcessBlocked
  • AsrAdobeReaderChildProcessWarnBypassed
  • AsrOfficeChildProcessAudited
  • AsrOfficeChildProcessBlocked
  • AsrOfficeChildProcessWarnBypassed
  • AsrOfficeCommAppChildProcessAudited
  • AsrOfficeCommAppChildProcessBlocked
  • AsrOfficeCommAppChildProcessWarnBypassed
  • AsrOfficeProcessInjectionAudited
  • AsrOfficeProcessInjectionBlocked
  • AsrOfficeProcessInjectionWarnBypassed
  • AsrPsexecWmiChildProcessAudited
  • AsrPsexecWmiChildProcessBlocked
  • AsrPsexecWmiChildProcessWarnBypassed
  • AsrUntrustedUsbProcessAudited
  • AsrUntrustedUsbProcessBlocked
  • AsrUntrustedUsbProcessWarnBypassed
  • ExploitGuardChildProcessAudited
  • ExploitGuardChildProcessBlocked
and if the properties.MD5 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.MD5 log field is mapped to the target.process.file.md5 UDM field.
Else, if the properties.MD5 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.MD5 log field is mapped to the target.file.md5 UDM field.
properties.FileName target.file.names If the properties.ActionType log field contains one of the following values:
  • AmsiScriptDetection
  • AppGuardCreateContainer
  • AppGuardLaunchedWithUrl
  • AppGuardResumeContainer
  • AppGuardStopContainer
  • AppGuardSuspendContainer
  • ClrUnbackedModuleLoaded
  • CreateRemoteThreadApiCall
  • DpapiAccessed
  • DriverLoad
  • GetAsyncKeyStateApiCall
  • GetClipboardData
  • MemoryRemoteProtect
  • NamedPipeEvent
  • NtAllocateVirtualMemoryApiCall
  • NtAllocateVirtualMemoryRemoteApiCall
  • NtMapViewOfSectionRemoteApiCall
  • NtProtectVirtualMemoryApiCall
  • OpenProcessApiCall
  • PowerShellCommand
  • ProcessCreatedUsingWmiQuery
  • ProcessPrimaryTokenModified
  • PTraceDetected
  • QueueUserApcRemoteApiCall
  • ReadProcessMemoryApiCall
  • RemoteWmiOperation
  • RemovableStoragePolicyTriggered
  • ScriptContent
  • SetThreadContextRemoteApiCall
  • WmiBindEventFilterToConsumer
  • WriteProcessMemoryApiCall
  • WriteToLsassProcessMemory
  • AsrAdobeReaderChildProcessAudited
  • AsrAdobeReaderChildProcessBlocked
  • AsrAdobeReaderChildProcessWarnBypassed
  • AsrOfficeChildProcessAudited
  • AsrOfficeChildProcessBlocked
  • AsrOfficeChildProcessWarnBypassed
  • AsrOfficeCommAppChildProcessAudited
  • AsrOfficeCommAppChildProcessBlocked
  • AsrOfficeCommAppChildProcessWarnBypassed
  • AsrOfficeProcessInjectionAudited
  • AsrOfficeProcessInjectionBlocked
  • AsrOfficeProcessInjectionWarnBypassed
  • AsrPsexecWmiChildProcessAudited
  • AsrPsexecWmiChildProcessBlocked
  • AsrPsexecWmiChildProcessWarnBypassed
  • AsrUntrustedUsbProcessAudited
  • AsrUntrustedUsbProcessBlocked
  • AsrUntrustedUsbProcessWarnBypassed
  • ExploitGuardChildProcessAudited
  • ExploitGuardChildProcessBlocked
then properties.FileName log field is mapped to the target.process.file.names UDM field.
Else, properties.FileName log field is mapped to the target.file.names UDM field.
properties.FileName target.process.file.names If the properties.ActionType log field contains one of the following values:
  • AmsiScriptDetection
  • AppGuardCreateContainer
  • AppGuardLaunchedWithUrl
  • AppGuardResumeContainer
  • AppGuardStopContainer
  • AppGuardSuspendContainer
  • ClrUnbackedModuleLoaded
  • CreateRemoteThreadApiCall
  • DpapiAccessed
  • DriverLoad
  • GetAsyncKeyStateApiCall
  • GetClipboardData
  • MemoryRemoteProtect
  • NamedPipeEvent
  • NtAllocateVirtualMemoryApiCall
  • NtAllocateVirtualMemoryRemoteApiCall
  • NtMapViewOfSectionRemoteApiCall
  • NtProtectVirtualMemoryApiCall
  • OpenProcessApiCall
  • PowerShellCommand
  • ProcessCreatedUsingWmiQuery
  • ProcessPrimaryTokenModified
  • PTraceDetected
  • QueueUserApcRemoteApiCall
  • ReadProcessMemoryApiCall
  • RemoteWmiOperation
  • RemovableStoragePolicyTriggered
  • ScriptContent
  • SetThreadContextRemoteApiCall
  • WmiBindEventFilterToConsumer
  • WriteProcessMemoryApiCall
  • WriteToLsassProcessMemory
  • AsrAdobeReaderChildProcessAudited
  • AsrAdobeReaderChildProcessBlocked
  • AsrAdobeReaderChildProcessWarnBypassed
  • AsrOfficeChildProcessAudited
  • AsrOfficeChildProcessBlocked
  • AsrOfficeChildProcessWarnBypassed
  • AsrOfficeCommAppChildProcessAudited
  • AsrOfficeCommAppChildProcessBlocked
  • AsrOfficeCommAppChildProcessWarnBypassed
  • AsrOfficeProcessInjectionAudited
  • AsrOfficeProcessInjectionBlocked
  • AsrOfficeProcessInjectionWarnBypassed
  • AsrPsexecWmiChildProcessAudited
  • AsrPsexecWmiChildProcessBlocked
  • AsrPsexecWmiChildProcessWarnBypassed
  • AsrUntrustedUsbProcessAudited
  • AsrUntrustedUsbProcessBlocked
  • AsrUntrustedUsbProcessWarnBypassed
  • ExploitGuardChildProcessAudited
  • ExploitGuardChildProcessBlocked
then properties.FileName log field is mapped to the target.process.file.names UDM field.
Else, properties.FileName log field is mapped to the target.file.names UDM field.
properties.SHA1 target.file.sha1 If the properties.ActionType log field contains one of the following values:
  • AmsiScriptDetection
  • AppGuardCreateContainer
  • AppGuardLaunchedWithUrl
  • AppGuardResumeContainer
  • AppGuardStopContainer
  • AppGuardSuspendContainer
  • ClrUnbackedModuleLoaded
  • CreateRemoteThreadApiCall
  • DpapiAccessed
  • DriverLoad
  • GetAsyncKeyStateApiCall
  • GetClipboardData
  • MemoryRemoteProtect
  • NamedPipeEvent
  • NtAllocateVirtualMemoryApiCall
  • NtAllocateVirtualMemoryRemoteApiCall
  • NtMapViewOfSectionRemoteApiCall
  • NtProtectVirtualMemoryApiCall
  • OpenProcessApiCall
  • PowerShellCommand
  • ProcessCreatedUsingWmiQuery
  • ProcessPrimaryTokenModified
  • PTraceDetected
  • QueueUserApcRemoteApiCall
  • ReadProcessMemoryApiCall
  • RemoteWmiOperation
  • RemovableStoragePolicyTriggered
  • ScriptContent
  • SetThreadContextRemoteApiCall
  • WmiBindEventFilterToConsumer
  • WriteProcessMemoryApiCall
  • WriteToLsassProcessMemory
  • AsrAdobeReaderChildProcessAudited
  • AsrAdobeReaderChildProcessBlocked
  • AsrAdobeReaderChildProcessWarnBypassed
  • AsrOfficeChildProcessAudited
  • AsrOfficeChildProcessBlocked
  • AsrOfficeChildProcessWarnBypassed
  • AsrOfficeCommAppChildProcessAudited
  • AsrOfficeCommAppChildProcessBlocked
  • AsrOfficeCommAppChildProcessWarnBypassed
  • AsrOfficeProcessInjectionAudited
  • AsrOfficeProcessInjectionBlocked
  • AsrOfficeProcessInjectionWarnBypassed
  • AsrPsexecWmiChildProcessAudited
  • AsrPsexecWmiChildProcessBlocked
  • AsrPsexecWmiChildProcessWarnBypassed
  • AsrUntrustedUsbProcessAudited
  • AsrUntrustedUsbProcessBlocked
  • AsrUntrustedUsbProcessWarnBypassed
  • ExploitGuardChildProcessAudited
  • ExploitGuardChildProcessBlocked
and if the properties.SHA1 log field value matches the regular expression pattern ^[0-9a-f]+$, then properties.SHA1 log field is mapped to the target.process.file.sha1 UDM field.
Else, if the properties.SHA1 log field value matches the regular expression pattern ^[0-9a-f]+$, then properties.SHA1 log field is mapped to the target.file.sha1 UDM field.
properties.SHA1 target.process.file.sha1 If the properties.ActionType log field contains one of the following values:
  • AmsiScriptDetection
  • AppGuardCreateContainer
  • AppGuardLaunchedWithUrl
  • AppGuardResumeContainer
  • AppGuardStopContainer
  • AppGuardSuspendContainer
  • ClrUnbackedModuleLoaded
  • CreateRemoteThreadApiCall
  • DpapiAccessed
  • DriverLoad
  • GetAsyncKeyStateApiCall
  • GetClipboardData
  • MemoryRemoteProtect
  • NamedPipeEvent
  • NtAllocateVirtualMemoryApiCall
  • NtAllocateVirtualMemoryRemoteApiCall
  • NtMapViewOfSectionRemoteApiCall
  • NtProtectVirtualMemoryApiCall
  • OpenProcessApiCall
  • PowerShellCommand
  • ProcessCreatedUsingWmiQuery
  • ProcessPrimaryTokenModified
  • PTraceDetected
  • QueueUserApcRemoteApiCall
  • ReadProcessMemoryApiCall
  • RemoteWmiOperation
  • RemovableStoragePolicyTriggered
  • ScriptContent
  • SetThreadContextRemoteApiCall
  • WmiBindEventFilterToConsumer
  • WriteProcessMemoryApiCall
  • WriteToLsassProcessMemory
  • AsrAdobeReaderChildProcessAudited
  • AsrAdobeReaderChildProcessBlocked
  • AsrAdobeReaderChildProcessWarnBypassed
  • AsrOfficeChildProcessAudited
  • AsrOfficeChildProcessBlocked
  • AsrOfficeChildProcessWarnBypassed
  • AsrOfficeCommAppChildProcessAudited
  • AsrOfficeCommAppChildProcessBlocked
  • AsrOfficeCommAppChildProcessWarnBypassed
  • AsrOfficeProcessInjectionAudited
  • AsrOfficeProcessInjectionBlocked
  • AsrOfficeProcessInjectionWarnBypassed
  • AsrPsexecWmiChildProcessAudited
  • AsrPsexecWmiChildProcessBlocked
  • AsrPsexecWmiChildProcessWarnBypassed
  • AsrUntrustedUsbProcessAudited
  • AsrUntrustedUsbProcessBlocked
  • AsrUntrustedUsbProcessWarnBypassed
  • ExploitGuardChildProcessAudited
  • ExploitGuardChildProcessBlocked
and if the properties.SHA1 log field value matches the regular expression pattern ^[0-9a-f]+$, then properties.SHA1 log field is mapped to the target.process.file.sha1 UDM field.
Else, if the properties.SHA1 log field value matches the regular expression pattern ^[0-9a-f]+$, then properties.SHA1 log field is mapped to the target.file.sha1 UDM field.
properties.SHA256 target.file.sha256 If the properties.ActionType log field contains one of the following values:
  • AmsiScriptDetection
  • AppGuardCreateContainer
  • AppGuardLaunchedWithUrl
  • AppGuardResumeContainer
  • AppGuardStopContainer
  • AppGuardSuspendContainer
  • ClrUnbackedModuleLoaded
  • CreateRemoteThreadApiCall
  • DpapiAccessed
  • DriverLoad
  • GetAsyncKeyStateApiCall
  • GetClipboardData
  • MemoryRemoteProtect
  • NamedPipeEvent
  • NtAllocateVirtualMemoryApiCall
  • NtAllocateVirtualMemoryRemoteApiCall
  • NtMapViewOfSectionRemoteApiCall
  • NtProtectVirtualMemoryApiCall
  • OpenProcessApiCall
  • PowerShellCommand
  • ProcessCreatedUsingWmiQuery
  • ProcessPrimaryTokenModified
  • PTraceDetected
  • QueueUserApcRemoteApiCall
  • ReadProcessMemoryApiCall
  • RemoteWmiOperation
  • RemovableStoragePolicyTriggered
  • ScriptContent
  • SetThreadContextRemoteApiCall
  • WmiBindEventFilterToConsumer
  • WriteProcessMemoryApiCall
  • WriteToLsassProcessMemory
  • AsrAdobeReaderChildProcessAudited
  • AsrAdobeReaderChildProcessBlocked
  • AsrAdobeReaderChildProcessWarnBypassed
  • AsrOfficeChildProcessAudited
  • AsrOfficeChildProcessBlocked
  • AsrOfficeChildProcessWarnBypassed
  • AsrOfficeCommAppChildProcessAudited
  • AsrOfficeCommAppChildProcessBlocked
  • AsrOfficeCommAppChildProcessWarnBypassed
  • AsrOfficeProcessInjectionAudited
  • AsrOfficeProcessInjectionBlocked
  • AsrOfficeProcessInjectionWarnBypassed
  • AsrPsexecWmiChildProcessAudited
  • AsrPsexecWmiChildProcessBlocked
  • AsrPsexecWmiChildProcessWarnBypassed
  • AsrUntrustedUsbProcessAudited
  • AsrUntrustedUsbProcessBlocked
  • AsrUntrustedUsbProcessWarnBypassed
  • ExploitGuardChildProcessAudited
  • ExploitGuardChildProcessBlocked
and if the properties.SHA256 log field value matches the regular expression pattern ^[a-f0-9]{64}$, then properties.SHA256 log field is mapped to the target.process.file.sha256 UDM field.
Else, if the properties.SHA256 log field value matches the regular expression pattern ^[a-f0-9]{64}$, then properties.SHA256 log field is mapped to the target.file.sha256 UDM field.
properties.SHA256 target.process.file.sha256 If the properties.ActionType log field contains one of the following values:
  • AmsiScriptDetection
  • AppGuardCreateContainer
  • AppGuardLaunchedWithUrl
  • AppGuardResumeContainer
  • AppGuardStopContainer
  • AppGuardSuspendContainer
  • ClrUnbackedModuleLoaded
  • CreateRemoteThreadApiCall
  • DpapiAccessed
  • DriverLoad
  • GetAsyncKeyStateApiCall
  • GetClipboardData
  • MemoryRemoteProtect
  • NamedPipeEvent
  • NtAllocateVirtualMemoryApiCall
  • NtAllocateVirtualMemoryRemoteApiCall
  • NtMapViewOfSectionRemoteApiCall
  • NtProtectVirtualMemoryApiCall
  • OpenProcessApiCall
  • PowerShellCommand
  • ProcessCreatedUsingWmiQuery
  • ProcessPrimaryTokenModified
  • PTraceDetected
  • QueueUserApcRemoteApiCall
  • ReadProcessMemoryApiCall
  • RemoteWmiOperation
  • RemovableStoragePolicyTriggered
  • ScriptContent
  • SetThreadContextRemoteApiCall
  • WmiBindEventFilterToConsumer
  • WriteProcessMemoryApiCall
  • WriteToLsassProcessMemory
  • AsrAdobeReaderChildProcessAudited
  • AsrAdobeReaderChildProcessBlocked
  • AsrAdobeReaderChildProcessWarnBypassed
  • AsrOfficeChildProcessAudited
  • AsrOfficeChildProcessBlocked
  • AsrOfficeChildProcessWarnBypassed
  • AsrOfficeCommAppChildProcessAudited
  • AsrOfficeCommAppChildProcessBlocked
  • AsrOfficeCommAppChildProcessWarnBypassed
  • AsrOfficeProcessInjectionAudited
  • AsrOfficeProcessInjectionBlocked
  • AsrOfficeProcessInjectionWarnBypassed
  • AsrPsexecWmiChildProcessAudited
  • AsrPsexecWmiChildProcessBlocked
  • AsrPsexecWmiChildProcessWarnBypassed
  • AsrUntrustedUsbProcessAudited
  • AsrUntrustedUsbProcessBlocked
  • AsrUntrustedUsbProcessWarnBypassed
  • ExploitGuardChildProcessAudited
  • ExploitGuardChildProcessBlocked
and if the properties.SHA256 log field value matches the regular expression pattern ^[a-f0-9]{64}$, then properties.SHA256 log field is mapped to the target.process.file.sha256 UDM field.
Else, if the properties.SHA256 log field value matches the regular expression pattern ^[a-f0-9]{64}$, then properties.SHA256 log field is mapped to the target.file.sha256 UDM field.
properties.FileSize target.file.size If the properties.ActionType log field contains one of the following values:
  • AmsiScriptDetection
  • AppGuardCreateContainer
  • AppGuardLaunchedWithUrl
  • AppGuardResumeContainer
  • AppGuardStopContainer
  • AppGuardSuspendContainer
  • ClrUnbackedModuleLoaded
  • CreateRemoteThreadApiCall
  • DpapiAccessed
  • DriverLoad
  • GetAsyncKeyStateApiCall
  • GetClipboardData
  • MemoryRemoteProtect
  • NamedPipeEvent
  • NtAllocateVirtualMemoryApiCall
  • NtAllocateVirtualMemoryRemoteApiCall
  • NtMapViewOfSectionRemoteApiCall
  • NtProtectVirtualMemoryApiCall
  • OpenProcessApiCall
  • PowerShellCommand
  • ProcessCreatedUsingWmiQuery
  • ProcessPrimaryTokenModified
  • PTraceDetected
  • QueueUserApcRemoteApiCall
  • ReadProcessMemoryApiCall
  • RemoteWmiOperation
  • RemovableStoragePolicyTriggered
  • ScriptContent
  • SetThreadContextRemoteApiCall
  • WmiBindEventFilterToConsumer
  • WriteProcessMemoryApiCall
  • WriteToLsassProcessMemory
  • AsrAdobeReaderChildProcessAudited
  • AsrAdobeReaderChildProcessBlocked
  • AsrAdobeReaderChildProcessWarnBypassed
  • AsrOfficeChildProcessAudited
  • AsrOfficeChildProcessBlocked
  • AsrOfficeChildProcessWarnBypassed
  • AsrOfficeCommAppChildProcessAudited
  • AsrOfficeCommAppChildProcessBlocked
  • AsrOfficeCommAppChildProcessWarnBypassed
  • AsrOfficeProcessInjectionAudited
  • AsrOfficeProcessInjectionBlocked
  • AsrOfficeProcessInjectionWarnBypassed
  • AsrPsexecWmiChildProcessAudited
  • AsrPsexecWmiChildProcessBlocked
  • AsrPsexecWmiChildProcessWarnBypassed
  • AsrUntrustedUsbProcessAudited
  • AsrUntrustedUsbProcessBlocked
  • AsrUntrustedUsbProcessWarnBypassed
  • ExploitGuardChildProcessAudited
  • ExploitGuardChildProcessBlocked
then properties.FileSize log field is mapped to the target.process.file.size UDM field.
Else, properties.FileSize log field is mapped to the target.file.size UDM field.
properties.FileSize target.process.file.size If the properties.ActionType log field contains one of the following values:
  • AmsiScriptDetection
  • AppGuardCreateContainer
  • AppGuardLaunchedWithUrl
  • AppGuardResumeContainer
  • AppGuardStopContainer
  • AppGuardSuspendContainer
  • ClrUnbackedModuleLoaded
  • CreateRemoteThreadApiCall
  • DpapiAccessed
  • DriverLoad
  • GetAsyncKeyStateApiCall
  • GetClipboardData
  • MemoryRemoteProtect
  • NamedPipeEvent
  • NtAllocateVirtualMemoryApiCall
  • NtAllocateVirtualMemoryRemoteApiCall
  • NtMapViewOfSectionRemoteApiCall
  • NtProtectVirtualMemoryApiCall
  • OpenProcessApiCall
  • PowerShellCommand
  • ProcessCreatedUsingWmiQuery
  • ProcessPrimaryTokenModified
  • PTraceDetected
  • QueueUserApcRemoteApiCall
  • ReadProcessMemoryApiCall
  • RemoteWmiOperation
  • RemovableStoragePolicyTriggered
  • ScriptContent
  • SetThreadContextRemoteApiCall
  • WmiBindEventFilterToConsumer
  • WriteProcessMemoryApiCall
  • WriteToLsassProcessMemory
  • AsrAdobeReaderChildProcessAudited
  • AsrAdobeReaderChildProcessBlocked
  • AsrAdobeReaderChildProcessWarnBypassed
  • AsrOfficeChildProcessAudited
  • AsrOfficeChildProcessBlocked
  • AsrOfficeChildProcessWarnBypassed
  • AsrOfficeCommAppChildProcessAudited
  • AsrOfficeCommAppChildProcessBlocked
  • AsrOfficeCommAppChildProcessWarnBypassed
  • AsrOfficeProcessInjectionAudited
  • AsrOfficeProcessInjectionBlocked
  • AsrOfficeProcessInjectionWarnBypassed
  • AsrPsexecWmiChildProcessAudited
  • AsrPsexecWmiChildProcessBlocked
  • AsrPsexecWmiChildProcessWarnBypassed
  • AsrUntrustedUsbProcessAudited
  • AsrUntrustedUsbProcessBlocked
  • AsrUntrustedUsbProcessWarnBypassed
  • ExploitGuardChildProcessAudited
  • ExploitGuardChildProcessBlocked
then properties.FileSize log field is mapped to the target.process.file.size UDM field.
Else, properties.FileSize log field is mapped to the target.file.size UDM field.
properties.RemoteDeviceName principal.hostname If the properties.ActionType log field contains one of the following values, then the properties.RemoteDeviceName log field is mapped to the principal.hostname and principal.asset.hostname UDM field:
  • RemoteWmiOperation
  • ProcessCreatedUsingWmiQuery
Else, the properties.RemoteDeviceName log field is mapped to the target.hostname and target.asset.hostname UDM fields.
properties.RemoteDeviceName principal.asset.hostname If the properties.ActionType log field contains one of the following values, then the properties.RemoteDeviceName log field is mapped to the principal.hostname and principal.asset.hostname UDM field:
  • RemoteWmiOperation
  • ProcessCreatedUsingWmiQuery
Else, the properties.RemoteDeviceName log field is mapped to the target.hostname and target.asset.hostname UDM fields.
properties.RemoteDeviceName target.hostname If the properties.ActionType log field contains one of the following values, then the properties.RemoteDeviceName log field is mapped to the principal.hostname and principal.asset.hostname UDM field:
  • RemoteWmiOperation
  • ProcessCreatedUsingWmiQuery
Else, the properties.RemoteDeviceName log field is mapped to the target.hostname and target.asset.hostname UDM fields.
properties.RemoteDeviceName target.asset.hostname If the properties.ActionType log field contains one of the following values, then the properties.RemoteDeviceName log field is mapped to the principal.hostname and principal.asset.hostname UDM field:
  • RemoteWmiOperation
  • ProcessCreatedUsingWmiQuery
Else, the properties.RemoteDeviceName log field is mapped to the target.hostname and target.asset.hostname UDM fields.
properties.RemoteIP principal.ip If the properties.ActionType log field contains one of the following values, then the properties.RemoteIP log field is mapped to the principal.ip and principal.asset.ip UDM field:
  • RemoteWmiOperation
  • ProcessCreatedUsingWmiQuery
Else, the properties.RemoteIP log field is mapped to the target.ip and target.asset.ip UDM fields.
properties.RemoteIP principal.asset.ip If the properties.ActionType log field contains one of the following values, then the properties.RemoteIP log field is mapped to the principal.ip and principal.asset.ip UDM field:
  • RemoteWmiOperation
  • ProcessCreatedUsingWmiQuery
Else, the properties.RemoteIP log field is mapped to the target.ip and target.asset.ip UDM fields.
properties.RemoteIP target.ip If the properties.ActionType log field contains one of the following values, then the properties.RemoteIP log field is mapped to the principal.ip and principal.asset.ip UDM field:
  • RemoteWmiOperation
  • ProcessCreatedUsingWmiQuery
Else, the properties.RemoteIP log field is mapped to the target.ip and target.asset.ip UDM fields.
properties.RemoteIP target.asset.ip If the properties.ActionType log field contains one of the following values, then the properties.RemoteIP log field is mapped to the principal.ip and principal.asset.ip UDM field:
  • RemoteWmiOperation
  • ProcessCreatedUsingWmiQuery
Else, the properties.RemoteIP log field is mapped to the target.ip and target.asset.ip UDM fields.
properties.RemotePort principal.port If the properties.ActionType log field contains one of the following values, then the properties.RemotePort log field is mapped to the principal.port UDM field:
  • RemoteWmiOperation
  • ProcessCreatedUsingWmiQuery
Else, the properties.RemotePort log field is mapped to the target.port UDM field.
properties.RemotePort target.port If the properties.ActionType log field contains one of the following values, then the properties.RemotePort log field is mapped to the principal.port UDM field:
  • RemoteWmiOperation
  • ProcessCreatedUsingWmiQuery
Else, the properties.RemotePort log field is mapped to the target.port UDM field.
properties.ProcessCommandLine target.process.command_line
properties.ProcessId target.process.pid
properties.ProcessTokenElevation target.process.token_elevation_type If the properties.ProcessTokenElevation log field value is equal to TokenElevationTypeFull, then the target.process.token_elevation_type UDM field is set to TYPE_1.

Else, if the properties.ProcessTokenElevation log field value is equal to TokenElevationTypeDefault, then the target.process.token_elevation_type UDM field is set to TYPE_2.

Else, if the properties.ProcessTokenElevation log field value is equal to TokenElevationTypeLimited, then the target.process.token_elevation_type UDM field is set to TYPE_3.
properties.RegistryKey target.registry.registry_key
properties.RegistryValueData target.registry.registry_value_data
properties.RegistryValueName target.registry.registry_value_name
properties.RemoteUrl principal.url If the properties.ActionType log field contains one of the following values, then the properties.RemoteUrl log field is mapped to the principal.url UDM field:
  • RemoteWmiOperation
  • ProcessCreatedUsingWmiQuery
Else, the properties.RemoteUrl log field is mapped to the target.url UDM field.
properties.RemoteUrl target.url If the properties.ActionType log field contains one of the following values, then the properties.RemoteUrl log field is mapped to the principal.url UDM field:
  • RemoteWmiOperation
  • ProcessCreatedUsingWmiQuery
Else, the properties.RemoteUrl log field is mapped to the target.url UDM field.
properties.AdditionalFields additional.fields[additional_fields]
properties.AppGuardContainerId additional.fields[app_guard_container_id]
properties.InitiatingProcessCreationTime additional.fields[initiating_process_creation_time]
properties.InitiatingProcessLogonId additional.fields[initiating_process_logon_id]
properties.InitiatingProcessParentCreationTime additional.fields[initiating_process_parent_creation_time]
properties.ProcessCreationTime additional.fields[process_creation_time]
properties.InitiatingProcessVersionInfoCompanyName principal.process.file.exif_info.company
properties.InitiatingProcessVersionInfoFileDescription principal.process.file.exif_info.file_description
properties.InitiatingProcessVersionInfoInternalFileName additional.fields[process_version_info_internal_file_name]
properties.InitiatingProcessVersionInfoOriginalFileName principal.process.file.exif_info.original_file
properties.InitiatingProcessVersionInfoProductName principal.process.file.exif_info.product
properties.InitiatingProcessVersionInfoProductVersion additional.fields[process_version_info_product_version]

필드 매핑 참조: MICROSOFT DEFENDER ENDPOINT - AlertEvidence

다음 표에는 AlertEvidence 로그 유형의 로그 필드와 해당 UDM 필드가 나와 있습니다.

Log field UDM mapping Logic
properties.Application principal.application
properties.ResourceType principal.resource.attribute.labels[resource_type]
metadata.event_type The metadata.event_type UDM field is set to SCAN_HOST.
properties.DeviceId
properties.AdditionalFields.MachineId
properties.AdditionalFields.Host.MachineId
properties.AdditionalFields.ImageFile.Host.MachineId
properties.AdditionalFields.ImageFile.Host.HostMachineId
properties.AdditionalFields.Host.HostMachineId
properties.AdditionalFields.Key.Device.MachineId
properties.AdditionalFields.Key.Device.HostMachineId		 principal.asset_id If the properties.DeviceId log field value is not empty then, DeviceID:properties.DeviceId is mapped to the principal.asset_id UDM field.
Else, if the properties.AdditionalFields.MachineId log field value is not empty then, DeviceID:properties.AdditionalFields.MachineId is mapped to the principal.asset_id UDM field.
Else, if the properties.AdditionalFields.Host.MachineId log field value is not empty then, DeviceID:properties.AdditionalFields.Host.MachineId is mapped to the principal.asset_id UDM field.
Else, if the properties.AdditionalFields.ImageFile.Host.MachineId log field value is not empty then, DeviceID:properties.AdditionalFields.ImageFile.Host.MachineId is mapped to the principal.asset_id UDM field.
Else, if the properties.AdditionalFields.ImageFile.Host.HostMachineId log field value is not empty then, DeviceID:properties.AdditionalFields.ImageFile.Host.HostMachineId is mapped to the principal.asset_id UDM field.
Else, if the properties.AdditionalFields.Host.HostMachineId log field value is not empty then, DeviceID:properties.AdditionalFields.Host.HostMachineId is mapped to the principal.asset_id UDM field.
Else, if the properties.AdditionalFields.Key.Device.MachineId log field value is not empty then, DeviceID:properties.AdditionalFields.Key.Device.MachineId is mapped to the principal.asset_id UDM field.
Else, if the properties.AdditionalFields.Key.Device.HostMachineId log field value is not empty then, DeviceID:properties.AdditionalFields.Key.Device.HostMachineId is mapped to the principal.asset_id UDM field.
properties.DeviceId
properties.AdditionalFields.MachineId
properties.AdditionalFields.Host.MachineId
properties.AdditionalFields.ImageFile.Host.MachineId
properties.AdditionalFields.ImageFile.Host.HostMachineId
properties.AdditionalFields.Host.HostMachineId
properties.AdditionalFields.Key.Device.MachineId
properties.AdditionalFields.Key.Device.HostMachineId		 principal.asset.asset_id If the properties.DeviceId log field value is not empty then, DeviceID:properties.DeviceId is mapped to the principal.asset.asset_id UDM field.
Else, if the properties.AdditionalFields.MachineId log field value is not empty then, DeviceID:properties.AdditionalFields.MachineId is mapped to the principal.asset.asset_id UDM field.
Else, if the properties.AdditionalFields.Host.MachineId log field value is not empty then, DeviceID:properties.AdditionalFields.Host.MachineId is mapped to the principal.asset.asset_id UDM field.
Else, if the properties.AdditionalFields.ImageFile.Host.MachineId log field value is not empty then, DeviceID:properties.AdditionalFields.ImageFile.Host.MachineId is mapped to the principal.asset.asset_id UDM field.
Else, if the properties.AdditionalFields.ImageFile.Host.HostMachineId log field value is not empty then, DeviceID:properties.AdditionalFields.ImageFile.Host.HostMachineId is mapped to the principal.asset.asset_id UDM field.
Else, if the properties.AdditionalFields.Host.HostMachineId log field value is not empty then, DeviceID:properties.AdditionalFields.Host.HostMachineId is mapped to the principal.asset.asset_id UDM field.
Else, if the properties.AdditionalFields.Key.Device.MachineId log field value is not empty then, DeviceID:properties.AdditionalFields.Key.Device.MachineId is mapped to the principal.asset.asset_id UDM field.
Else, if the properties.AdditionalFields.Key.Device.HostMachineId log field value is not empty then, DeviceID:properties.AdditionalFields.Key.Device.HostMachineId is mapped to the principal.asset.asset_id UDM field.
properties.DeviceName
properties.AdditionalFields.HostName
properties.AdditionalFields.Host.HostName
properties.AdditionalFields.ImageFile.Host.HostName
properties.AdditionalFields.Key.Device.HostName		 principal.hostname If the properties.DeviceName log field value is not empty then, properties.DeviceName log field is mapped to the principal.hostname UDM field.
Else, if the properties.AdditionalFields.HostName log field value is not empty then, properties.AdditionalFields.HostName log field is mapped to the principal.hostname UDM field.
Else, if the properties.AdditionalFields.ImageFile.Host.HostName log field value is not empty then, properties.AdditionalFields.ImageFile.Host.HostName log field is mapped to the principal.hostname UDM field.
Else, if the properties.AdditionalFields.Host.HostName log field value is not empty then, properties.AdditionalFields.Host.HostName log field is mapped to the principal.hostname UDM field.
Else, if the properties.AdditionalFields.Key.Device.HostName log field value is not empty then, properties.AdditionalFields.Key.Device.HostName log field is mapped to the principal.hostname UDM field.
properties.DeviceName
properties.AdditionalFields.HostName
properties.AdditionalFields.Host.HostName
properties.AdditionalFields.ImageFile.Host.HostName
properties.AdditionalFields.Key.Device.HostName		 principal.asset.hostname If the properties.DeviceName log field value is not empty then, properties.DeviceName log field is mapped to the principal.asset.hostname UDM field.
Else, if the properties.AdditionalFields.HostName log field value is not empty then, properties.AdditionalFields.HostName log field is mapped to the principal.asset.hostname UDM field.
Else, if the properties.AdditionalFields.ImageFile.Host.HostName log field value is not empty then, properties.AdditionalFields.ImageFile.Host.HostName log field is mapped to the principal.asset.hostname UDM field.
Else, if the properties.AdditionalFields.Host.HostName log field value is not empty then, properties.AdditionalFields.Host.HostName log field is mapped to the principal.asset.hostname UDM field.
Else, if the properties.AdditionalFields.Key.Device.HostName log field value is not empty then, properties.AdditionalFields.Key.Device.HostName log field is mapped to the principal.asset.hostname UDM field.
properties.LocalIP principal.asset.ip If the properties.LocalIP log field value is not empty, then the properties.LocalIP log field is mapped to the principal.asset.ip UDM field.
properties.FolderPath target.file.full_path If the properties.FileName log field value matches the regular expression pattern the properties.FolderPath, then the properties.FolderPath log field is mapped to the target.file.full_path UDM field.

Else, the properties.FolderPath/properties.FileName log field is mapped to the target.file.full_path UDM field.
properties.FileName target.file.names
properties.SHA1 target.file.sha1 If the properties.SHA1 log field value matches the regular expression pattern ^the 0-9a-f log field value+$, then the properties.SHA1 log field is mapped to the target.file.sha1 UDM field.
properties.SHA256 target.file.sha256 If the properties.SHA256 log field value matches the regular expression pattern ^the a-f0-9, then 64$, then the properties.SHA256 log field is mapped to the target.file.sha256 UDM field.
properties.FileSize target.file.size
properties.AccountDomain principal.administrative_domain
properties.RemoteIP target.ip
properties.AdditionalFields additional.fields[additionalfields]
properties.ProcessCommandLine target.process.command_line
properties.RegistryKey target.registry.registry_key
properties.RegistryValueData target.registry.registry_value_data
properties.RegistryValueName target.registry.registry_value_name
properties.CloudPlatform principal.resource.attribute.cloud.environment If the properties.CloudPlatform log field value matches the regular expression pattern /(?i)Amazon Web Services/, then the principal.resource.attribute.cloud.environment UDM field is set to AMAZON_WEB_SERVICES.

Else, if the properties.CloudPlatform log field value matches the regular expression pattern /(?i)Google Cloud Platform/, then the principal.resource.attribute.cloud.environment UDM field is set to GOOGLE_CLOUD_PLATFORM.

Else, if the properties.CloudPlatform log field value matches one of the regular expression patterns /(?i)Azure/ or /(?i)Azure Arc/, then the principal.resource.attribute.cloud.environment UDM field is set to MICROSOFT_AZURE.

Else, the principal.resource.attribute.cloud.environment UDM field is set to UNSPECIFIED_CLOUD_ENVIRONMENT.
properties.SubscriptionId principal.resource.attribute.labels[subscription_id]
properties.CloudResource principal.resource.name
properties.ResourceID principal.resource.product_object_id
principal.resource.resource_type The principal.resource.resource_type UDM field is set to CLOUD_PROJECT.
properties.Categories security_result.category_details
properties.Severity security_result.severity
properties.Title security_result.threat_name
properties.ThreatFamily security_result.detection_fields[threat_family]
properties.RemoteUrl target.url
properties.EvidenceDirection additional.fields[evidence_direction]
properties.EvidenceRole additional.fields[evidence_role]
properties.AccountObjectId additional.fields[account_object_id]
properties.AccountUpn principal.user.user_display_name
properties.AccountName principal.user.userid
properties.AccountSid principal.user.windows_sid
properties.Timestamp metadata.event_timestamp
properties.EntityType principal.resource.resource_subtype
properties.AlertId metadata.product_log_id
properties.DetectionSource security_result.about.resource.attribute.labels[detection_source]
properties.ServiceSource security_result.about.resource.attribute.labels[service_source]
properties.AttackTechniques security_result.attack_details.techniques.name
properties.ApplicationId additional.fields[application_id]
properties.EmailSubject network.email.subject
properties.NetworkMessageId network.email.mail_id
properties.OAuthApplicationId additional.fields[oauth_application_id]

필드 매핑 참조: MICROSOFT DEFENDER ENDPOINT - AlertInfo

다음 표에는 AlertInfo 로그 유형의 로그 필드와 해당 UDM 필드가 나와 있습니다.

Log field UDM mapping Logic
properties.Timestamp metadata.event_timestamp
metadata.event_type The metadata.event_type UDM field is set to GENERIC_EVENT.
properties.AlertId security_result.threat_id
properties.AttackTechniques security_result.attack_details.techniques.name
properties.DetectionSource security_result.detection_fields[detection_source]
properties.ServiceSource principal.application
properties.Severity security_result.severity If the properties.Severity log field value matches the regular expression pattern (?i)(informational), then the security_result.severity UDM field is set to INFORMATIONAL.

Else, if the properties.Severity log field value matches the regular expression pattern (?i)(low), then the security_result.severity UDM field is set to LOW.

Else, if the properties.Severity log field value matches the regular expression pattern (?i)(medium), then the security_result.severity UDM field is set to MEDIUM.

Else, if the properties.Severity log field value matches the regular expression pattern (?i)(high), then the security_result.severity UDM field is set to HIGH.
properties.Category security_result.category_details
properties.Title security_result.threat_name
properties.Title security_result.rule_name

필드 매핑 참조: MICROSOFT DEFENDER ENDPOINT - DeviceAlertEvents

다음 표에는 DeviceAlertEvents 로그 유형의 로그 필드와 해당 UDM 필드가 나와 있습니다.

Log field UDM mapping Logic
properties.Timestamp metadata.event_timestamp
metadata.event_type The metadata.event_type UDM field is set to SCAN_HOST.
properties.ReportId security_result.detection_fields[report_id]
properties.DeviceId principal.asset_id The principal.asset_id is set to DeviceID:%{properties.DeviceId}.
properties.MachineGroup principal.group.group_display_name
properties.DeviceName principal.hostname
properties.AttackTechniques security_result.attack_details.techniques.name
properties.Category security_result.category_details
properties.AlertId metadata.product_log_id
properties.MitreTechniques security_result.detection_fields[mitre_techniques]
properties.Severity security_result.severity If the properties.Severity log field value is equal to High, then the security_result.severity UDM field is set to HIGH.

Else, if the properties.Severity log field value is equal to Medium, then the security_result.severity UDM field is set to MEDIUM.

Else, if the properties.Severity log field value is equal to Low, then the security_result.severity UDM field is set to LOW.

Else, if the properties.Severity log field value is equal to Informational, then the security_result.severity UDM field is set to INFORMATIONAL.
properties.Title security_result.threat_name
properties.Title security_result.rule_name
properties.RemoteIp target.ip
properties.FileName target.file.names
properties.SHA1 target.file.sha1 If the properties.SHA1 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.SHA1 log field is mapped to the target.file.sha1 UDM field.
properties.RemoteUrl target.url
properties.Table additional.fields[table]

필드 매핑 참조: MICROSOFT DEFENDER ENDPOINT - DeviceFileCertificateInfo

다음 표에는 DeviceFileCertificateInfo 로그 유형의 로그 필드와 해당 UDM 필드가 나와 있습니다.

Log field UDM mapping Logic
properties.Timestamp metadata.creation_timestamp
metadata.event_type The metadata.entity_type UDM field is set to FILE.
properties.ReportId metadata.product_entity_id
properties.DeviceId entity.asset_id The entity.asset_id is set to DeviceID:%{properties.DeviceId}.
properties.SHA1 entity.file.sha1 If the properties.SHA1 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.SHA1 log field is mapped to the entity.file.sha1 UDM field.
properties.Issuer entity.file.signature_info.sigcheck.signers.cert_issuer
properties.Signer entity.file.signature_info.sigcheck.signers.name
properties.IsSigned entity.file.signature_info.sigcheck.verified If the properties.IsSigned log field value is equal to true, then the entity.file.signature_info.sigcheck.verified UDM field is set to TRUE.

Else, the entity.file.signature_info.sigcheck.verified UDM field is set to FALSE.
properties.DeviceName entity.asset.hostname
properties.CertificateCountersignatureTime additional.fields[certificate_countersignature_time]
properties.CertificateSerialNumber entity.file.signature_info.sigcheck.x509.serial_number
properties.CertificateCreationTime additional.fields[certification_creation_time]
properties.CertificateExpirationTime additional.fields[certification_expiration_time]
properties.CrlDistributionPointUrls additional.fields[crl_distribution_point_urls]
properties.IsRootSignerMicrosoft additional.fields[is_root_signer_microsoft]
properties.IsTrusted additional.fields[is_trusted]
properties.IssuerHash additional.fields[issuer_hash]
properties.SignatureType additional.fields[signature_type]
properties.SignerHash additional.fields[signer_hash]

필드 매핑 참조: MICROSOFT DEFENDER ENDPOINT - DeviceImageLoadEvents

다음 표에는 DeviceImageLoadEvents 로그 유형의 로그 필드와 해당 UDM 필드가 나와 있습니다.

Log field UDM mapping Logic
properties.InitiatingProcessSessionId additional.fields[initiating_process_session_id]
properties.IsInitiatingProcessRemoteSession additional.fields[is_initiating_process_remote_session]
properties.InitiatingProcessRemoteSessionDeviceName src.hostname
properties.InitiatingProcessRemoteSessionIP src.ip
properties.Timestamp metadata.event_timestamp
metadata.event_type The metadata.event_type UDM field is set to PROCESS_MODULE_LOAD.
properties.ReportId metadata.product_log_id
properties.InitiatingProcessAccountDomain principal.administrative_domain
principal.DeviceId principal.asset_id The principal.asset_id is set to DeviceID:%{principal.DeviceId}.
properties.DeviceName principal.hostname
properties.InitiatingProcessCommandLine principal.process.command_line
properties.InitiatingProcessFolderPath principal.process.file.full_path If the properties.InitiatingProcessFolderPath log field value matches the regular expression pattern the properties.InitiatingProcessFileName log field value, then the properties.InitiatingProcessFolderPath log field is mapped to the principal.process.file.full_path UDM field.

Else, the principal.process.file.full_path is set to %{properties.InitiatingProcessFolderPath}/%{properties.InitiatingProcessFileName}.
properties.InitiatingProcessMD5 principal.process.file.md5 If the properties.InitiatingProcessMD5 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.InitiatingProcessMD5 log field is mapped to the principal.process.file.md5 UDM field.
properties.InitiatingProcessFileName principal.process.file.names
properties.InitiatingProcessSHA1 principal.process.file.sha1 If the properties.InitiatingProcessSHA1 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.InitiatingProcessSHA1 log field is mapped to the principal.process.file.sha1 UDM field.
properties.InitiatingProcessSHA256 principal.process.file.sha256 If the properties.InitiatingProcessSHA256 log field value matches the regular expression pattern ^[a-f0-9]{64}$, then the properties.InitiatingProcessSHA256 log field is mapped to the principal.process.file.sha256 UDM field.
properties.InitiatingProcessFileSize principal.process.file.size
properties.InitiatingProcessParentFileName principal.process.parent_process.file.names
properties.InitiatingProcessParentId principal.process.parent_process.pid
properties.InitiatingProcessId principal.process.pid
properties.InitiatingProcessTokenElevation principal.process.token_elevation_type If the properties.InitiatingProcessTokenElevation log field value is equal to TokenElevationTypeFull, then the principal.process.token_elevation_type UDM field is set to TYPE_1.

Else, if the properties.InitiatingProcessTokenElevation log field value is equal to TokenElevationTypeDefault, then the principal.process.token_elevation_type UDM field is set to TYPE_2.

Else, if the properties.InitiatingProcessTokenElevation log field value is equal to TokenElevationTypeLimited, then the principal.process.token_elevation_type UDM field is set to TYPE_3.
properties.InitiatingProcessAccountObjectId principal.user.product_object_id
properties.InitiatingProcessAccountUpn principal.user.user_display_name
properties.InitiatingProcessAccountName principal.user.userid
properties.InitiatingProcessAccountSid principal.user.windows_sid
properties.FolderPath target.process.file.full_path If the properties.FolderPath log field value matches the regular expression pattern the properties.FileName, then the properties.FolderPath log field is mapped to the target.process.file.full_path UDM field.

Else, the target.process.file.full_pathis set to %{properties.FolderPath}/%{properties.FileName}.
properties.MD5 target.process.file.md5 If the properties.MD5 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.MD5 log field is mapped to the target.process.file.md5 UDM field.
properties.FileName target.process.file.names
properties.SHA1 target.process.file.sha1 If the properties.SHA1 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.SHA1 log field is mapped to the target.process.file.sha1 UDM field.
properties.SHA256 target.process.file.sha256 If the properties.SHA256 log field value matches the regular expression pattern ^[a-f0-9]{64}$, then the properties.SHA256 log field is mapped to the target.process.file.sha256 UDM field.
properties.FileSize target.process.file.size
properties.FolderPath target.file.full_path If the properties.FolderPath log field value matches the regular expression pattern the properties.FileName, then the properties.FolderPath log field is mapped to the target.file.full_path UDM field.

Else, the target.file.full_pathis set to %{properties.FolderPath}/%{properties.FileName}.
properties.MD5 target.file.md5 If the properties.MD5 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.MD5 log field is mapped to the target.process.file.md5 UDM field.
properties.FileName target.file.names
properties.SHA1 target.file.sha1 If the properties.SHA1 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.SHA1 log field is mapped to the target.file.sha1 UDM field.
properties.SHA256 target.file.sha256 If the properties.SHA256 log field value matches the regular expression pattern ^[a-f0-9]{64}$, then the properties.SHA256 log field is mapped to the target.file.sha256 UDM field.
properties.FileSize target.file.size
properties.AppGuardContainerId additional.fields[app_guard_container_id]
properties.InitiatingProcessCreationTime additional.fields[initiating_process_creation_time]
properties.InitiatingProcessIntegrityLevel additional.fields[initiating_process_integrity_level]
properties.InitiatingProcessParentCreationTime additional.fields[initiating_process_parent_creation_time]
properties.InitiatingProcessVersionInfoCompanyName principal.process.file.exif_info.company
properties.InitiatingProcessVersionInfoFileDescription principal.process.file.exif_info.file_description
properties.InitiatingProcessVersionInfoInternalFileName additional.fields[initiating_process_version_info_internal_file_name]
properties.InitiatingProcessVersionInfoOriginalFileName principal.process.file.exif_info.original_file
properties.InitiatingProcessVersionInfoProductName principal.process.file.exif_info.product
properties.InitiatingProcessVersionInfoProductVersion additional.fields[initiating_process_version_info_product_version]

필드 매핑 참조: MICROSOFT DEFENDER ENDPOINT - DeviceFileEvents

다음 표에는 DeviceFileEvents 로그 유형의 로그 필드와 해당 UDM 필드가 나와 있습니다.

Log field UDM mapping Logic
properties.InitiatingProcessSessionId additional.fields[initiating_process_session_id]
properties.IsInitiatingProcessRemoteSession additional.fields[is_initiating_process_remote_session]
properties.InitiatingProcessRemoteSessionDeviceName additional.fields[initiating_process_remote_session_device_name]
properties.InitiatingProcessRemoteSessionIP additional.fields[initiating_process_remote_session_ip]
properties.Timestamp metadata.event_timestamp
properties.ActionType metadata.event_type If the properties.ActionType log field value is equal to FileCreated, then the metadata.event_type UDM field is set to FILE_CREATION.

Else, if the properties.ActionType log field value is equal to FileDeleted, then the metadata.event_type UDM field is set to FILE_DELETION.

Else, if the properties.ActionType log field value is equal to FileModified, then the metadata.event_type UDM field is set to FILE_MODIFICATION.

Else, if the properties.ActionType log field value is equal to FileRenamed, then the metadata.event_type UDM field is set to FILE_MOVE.
properties.ReportId metadata.product_log_id
properties.RequestProtocol network.application_protocol If the properties.RequestProtocol log field value is equal to SMB, then the network.application_protocol UDM field is set to SMB.

Else, if the properties.RequestProtocol log field value is equal to NFS, then the network.application_protocol UDM field is set to NFS.

Else, if the properties.RequestProtocol log field value is equal to Local, then the network.application_protocol UDM field is set to UNKNOWN_APPLICATION_PROTOCOL.
properties.FileOriginReferrerUrl network.http.referral_url
properties.InitiatingProcessAccountDomain principal.administrative_domain If the properties.InitiatingProcessAccountDomain log field value is not empty, then the properties.InitiatingProcessAccountDomain log field is mapped to the principal.administrative_domain UDM field.
properties.RequestAccountDomain principal.administrative_domain If the properties.InitiatingProcessAccountDomain log field value is empty, then the properties.RequestAccountDomain log field is mapped to the principal.administrative_domain UDM field.
properties.DeviceId principal.asset_id The principal.asset_id is set to DeviceID:%{properties.DeviceId}.
properties.DeviceName principal.hostname
properties.FileOriginIP src.ip
properties.RequestSourceIP src.ip
properties.RequestSourcePort src.port
properties.InitiatingProcessCommandLine principal.process.command_line
properties.InitiatingProcessFolderPath principal.process.file.full_path If the properties.InitiatingProcessFolderPath log field value matches the regular expression pattern the properties.InitiatingProcessFileName log field value, then the properties.InitiatingProcessFolderPath log field is mapped to the principal.process.file.full_path UDM field.

Else, the principal.process.file.full_path is set to %{properties.InitiatingProcessFolderPath}/%{properties.InitiatingProcessFileName}.
properties.InitiatingProcessMD5 principal.process.file.md5 If the properties.InitiatingProcessMD5 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.InitiatingProcessMD5 log field is mapped to the principal.process.file.md5 UDM field.
properties.InitiatingProcessFileName principal.process.file.names
properties.InitiatingProcessSHA1 principal.process.file.sha1 If the properties.InitiatingProcessSHA1 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.InitiatingProcessSHA1 log field is mapped to the principal.process.file.sha1 UDM field.
properties.InitiatingProcessSHA256 principal.process.file.sha256 If the properties.InitiatingProcessSHA256 log field value matches the regular expression pattern ^[a-f0-9]{64}$, then the properties.InitiatingProcessSHA256 log field is mapped to the principal.process.file.sha256 UDM field.
properties.InitiatingProcessFileSize principal.process.file.size
properties.InitiatingProcessParentId principal.process.parent_process.pid
properties.InitiatingProcessParentFileName principal.process.parent_process.file.names
properties.InitiatingProcessId principal.process.pid
properties.InitiatingProcessTokenElevation principal.process.token_elevation_type If the properties.InitiatingProcessTokenElevation log field value is equal to TokenElevationTypeFull, then the principal.process.token_elevation_type UDM field is set to TYPE_1.

Else, if the properties.InitiatingProcessTokenElevation log field value is equal to TokenElevationTypeDefault, then the principal.process.token_elevation_type UDM field is set to TYPE_2.

Else, if the properties.InitiatingProcessTokenElevation log field value is equal to TokenElevationTypeLimited, then the principal.process.token_elevation_type UDM field is set to TYPE_3.
properties.FileOriginUrl src.url
properties.InitiatingProcessAccountObjectId principal.user.product_object_id
properties.InitiatingProcessAccountUpn principal.user.user_display_name
properties.InitiatingProcessAccountName principal.user.userid If the properties.InitiatingProcessAccountName log field value is not empty, then the properties.InitiatingProcessAccountName log field is mapped to the principal.user.userid UDM field.
properties.RequestAccountName principal.user.userid If the properties.InitiatingProcessAccountName log field value is empty, then the properties.RequestAccountName log field is mapped to the principal.user.userid UDM field.
properties.InitiatingProcessAccountSid principal.user.windows_sid If the properties.InitiatingProcessAccountSid log field value is not empty, then the properties.InitiatingProcessAccountSid log field is mapped to the principal.user.windows_sid UDM field.
properties.RequestAccountSid principal.user.windows_sid If the properties.InitiatingProcessAccountSid log field value is empty, then the properties.RequestAccountSid log field is mapped to the principal.user.windows_sid UDM field.
properties.PreviousFolderPath src.file.full_path If the properties.PreviousFolderPath log field value matches the regular expression pattern the properties.PreviousFileName log field value, then the properties.PreviousFolderPath log field is mapped to the src.file.full_path UDM field.

Else, src.file.full_path set to the %{properties.PreviousFolderPath}/%{properties.PreviousFileName}.
properties.PreviousFileName src.file.names
properties.FolderPath target.file.full_path If the properties.FolderPath log field value matches the regular expression pattern the properties.FileName log field value, then the properties.FolderPath log field is mapped to the target.file.full_path UDM field.

Else, the target.file.full_path set to %{properties.FolderPath}/%{properties.FileName}.
properties.MD5 target.file.md5 If the properties.MD5 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.MD5 log field is mapped to the target.file.md5 UDM field.
properties.FileName target.file.names
properties.SHA1 target.file.sha1 If the properties.SHA1 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.SHA1 log field is mapped to the target.file.sha1 UDM field.
properties.SHA256 target.file.sha256 If the properties.SHA256 log field value matches the regular expression pattern ^[a-f0-9]{64}$, then the properties.SHA256 log field is mapped to the target.file.sha256 UDM field.
properties.FileSize target.file.size
properties.SensitivityLabel target.file.tags
properties.SensitivitySubLabel target.file.tags
properties.AdditionalFields additional.fields[additional_fields]
properties.AppGuardContainerId additional.fields[app_guard_container_id]
properties.InitiatingProcessCreationTime additional.fields[initiating_process_creation_time]
properties.InitiatingProcessIntegrityLevel additional.fields[initiating_process_integrity_level]
properties.InitiatingProcessVersionInfoCompanyName principal.process.file.exif_info.company
properties.InitiatingProcessVersionInfoFileDescription principal.process.file.exif_info.file_description
properties.InitiatingProcessVersionInfoInternalFileName additional.fields[initiating_process_version_info_internal_file_name]
properties.InitiatingProcessVersionInfoOriginalFileName principal.process.file.exif_info.original_file
properties.InitiatingProcessVersionInfoProductName principal.process.file.exif_info.product
properties.InitiatingProcessVersionInfoProductVersion additional.fields[initiating_process_version_info_product_version]
properties.InitiatingProcessParentCreationTime additional.fields[initiating_process_parent_creation_time]
properties.IsAzureInfoProtectionApplied additional.fields[is_azure_info_protection_applied]
properties.ShareName additional.fields[share_name]

필드 매핑 참조: MICROSOFT DEFENDER ENDPOINT - DeviceInfo

다음 표에는 DeviceInfo 로그 유형의 로그 필드와 해당 UDM 필드가 나와 있습니다.

Log field UDM mapping Logic
properties.AzureResourceId entity.asset.attribute.labels[azure_resource_id]
properties.AwsResourceName entity.asset.attribute.labels[aws_resource_name]
properties.GcpFullResourceName entity.asset.attribute.labels[gcp_full_resource_name]
properties.HardwareUuid entity.asset.hardware.serial_number
properties.AzureVmId entity.asset.attribute.labels[azure_vm_id]
properties.AzureVmSubscriptionId entity.asset.attribute.labels[azure_vm_subscription_id]
properties.IsTransient entity.asset.attribute.labels[is_transient]
properties.OsBuildRevision entity.asset.attribute.labels[os_build_revision]
properties.MitigationStatus entity.asset.attribute.labels[mitigation_status]
properties.Site entity.asset.location.name
properties.DiscoverySources entity.asset.attribute.labels[discovery_sources]
properties.CloudPlatforms entity.asset.attribute.cloud.environment If the properties.CloudPlatforms log field value matches the regular expression pattern /(?i)Amazon Web Services/, then the entity.asset.attribute.cloud.environment UDM field is set to AMAZON_WEB_SERVICES.

Else, if the properties.CloudPlatforms log field value matches the regular expression pattern /(?i)Google Cloud Platform/, then the entity.asset.attribute.cloud.environment UDM field is set to GOOGLE_CLOUD_PLATFORM.

Else, if the properties.CloudPlatforms log field value matches one of the regular expression patterns /(?i)Azure/ or /(?i)Azure Arc/, then the entity.asset.attribute.cloud.environment UDM field is set to MICROSOFT_AZURE.
properties.DeviceId entity.asset_id The entity.asset_id is set to DeviceID:%{properties.DeviceId}.
properties.DeviceId entity.asset.asset_id The entity.asset.asset_id is set to DeviceID:%{properties.DeviceId}.
properties.AadDeviceId entity.asset.attribute.labels[aad_device_id]
properties.AdditionalFields entity.asset.attribute.labels[additional_fields]
properties.ConnectivityType entity.asset.attribute.labels[connectivity_type]
properties.DeviceDynamicTags entity.asset.attribute.labels[device_dynamic_tags]
properties.DeviceManualTags entity.asset.attribute.labels[device_manual_tags]
properties.DeviceSubtype entity.asset.attribute.labels[device_subtype]
properties.HostDeviceId entity.asset.attribute.labels[host_device_id]
properties.IsAzureADJoined entity.asset.attribute.labels[is_azure_ad_joined]
properties.IsInternetFacing entity.asset.attribute.labels[is_internet_facing]
properties.JoinType entity.asset.attribute.labels[join_type]
properties.MergedDeviceIds entity.asset.attribute.labels[merged_device_ids]
properties.MergedToDeviceId entity.asset.attribute.labels[merged_to_device_id]
properties.OnboardingStatus entity.asset.attribute.labels[onboarding_status]
properties.OSArchitecture entity.asset.attribute.labels[os_architecture]
properties.OSDistribution entity.asset.attribute.labels[os_distribution]
properties.OSVersionInfo entity.asset.attribute.labels[os_version_info]
properties.RegistryDeviceTag entity.asset.attribute.labels[registry_divice_tag]
properties.ReportId entity.asset.attribute.labels[report_id]
properties.SensorHealthState entity.asset.attribute.labels[sensor_health_state]
properties.DeviceCategory entity.asset.category
properties.Vendor entity.asset.hardware.manufacturer
properties.Model entity.asset.hardware.model
properties.DeviceName entity.asset.hostname
properties.PublicIP entity.asset.nat_ip
properties.OSBuild entity.asset.platform_software.plateform_patch_level
properties.OSPlatform entity.asset.platform_software.platform If the properties.OSPlatform log field value matches the regular expression pattern (?i)macos, then the entity.asset.platform_software.platform UDM field is set to MAC.

Else, if the properties.OSPlatform log field value matches the regular expression pattern (?i)windows, then the entity.asset.platform_software.platform UDM field is set to WINDOWS.

Else, if the properties.OSPlatform log field value matches the regular expression pattern (?i)linux, then the entity.asset.platform_software.platform UDM field is set to LINUX.
properties.OSVersion entity.asset.platform_software.platform_version
properties.ClientVersion entity.asset.software.version
properties.DeviceType entity.asset.type If the properties.DeviceType log field value is equal to NetworkDevice, then the entity.asset.type UDM field is set to NETWORK_ATTACHED_STORAGE.
Else, if the properties.DeviceType log field value is equal to Workstation, then the entity.asset.type UDM field is set to WORKSTATION.
Else, if the properties.DeviceType log field value is equal to Server, then the entity.asset.type UDM field is set to SERVER.
Else, if the properties.DeviceType log field value is equal to Mobile, then the entity.asset.type UDM field is set to MOBILE.
Else if the properties.DeviceType log field value is equal to Printer, then the entity.asset.type UDM field is set to PRINTER.
Else, the entity.asset.type UDM field is set to ROLE_UNSPECIFIED and properties.DeviceType is mapped to entity.asset.attribute.labels[device_type].
properties.MachineGroup entity.group.group_display_name
properties.ExclusionReason entity.security_result.detection_fields[exclusion_reason]
properties.ExposureLevel entity.security_result.detection_fields[exposure_level]
properties.IsExcluded entity.security_result.detection_fields[is_excluded]
properties.AssetValue entity.security_result.priority If the properties.AssetValue log field value is equal to High, then the entity.security_result.priority UDM field is set to HIGH_PRIORITY.

Else, if the properties.AssetValue log field value is equal to Medium, then the entity.security_result.priority UDM field is set to MEDIUM_PRIORITY.

Else, if the properties.AssetValue log field value is equal to Low, then the entity.security_result.priority UDM field is set to LOW_PRIORITY.

Else, the properties.AssetValue log field is mapped to the entity.security_result.detection_fields.asset_value UDM field.
properties.Timestamp metadata.creation_timestamp
metadata.entity_type The metadata.entity_type UDM field is set to ASSET.
properties.DeviceId metadata.product_entity_id The metadata.product_entity_id is set to DeviceID:%{properties.DeviceId}.
relations.direction The relations.direction UDM field is set to UNIDIRECTIONAL.
relations.entity_type The relations.entity_type UDM field is set to USER.
relations.relationship The relations.relationship UDM field is set to MEMBER.
properties.LoggedOnUsers.DomainName relations.entity.domain.name
properties.LoggedOnUsers.UserName relations.entity.user.userid
properties.LoggedOnUsers.Sid relations.entity.user.windows_sid
properties.LoggedOnUsers

필드 매핑 참조: MICROSOFT DEFENDER ENDPOINT - IdentityLogonEvents

다음 표에는 IdentityLogonEvents 로그 유형의 로그 필드와 해당 UDM 필드가 나와 있습니다.

Log field UDM mapping Logic
properties.ActionType security_result.action If the properties.ActionType log field value matches the regular expression pattern (?i)LogonSuccess, then the security_result.action UDM field is set to ALLOW.
Else if the properties.ActionType log field value matches the regular expression pattern (?i)LogonBlocked, then the security_result.action UDM field is set to BLOCK.
Else if the properties.ActionType log field value matches the regular expression pattern (?i)LogonFailed, then the security_result.action UDM field is set to FAIL.
Else, the security_result.action UDM field is set to UNKNOWN_ACTION.
properties.LogonType extensions.auth.mechanism If the properties.LogonType log field value is equal to Interactive, then the extensions.auth.mechanism UDM field is set to INTERACTIVE.
Else, if the properties.LogonType log field value is equal to Network, then the extensions.auth.mechanism UDM field is set to NETWORK.
Else, if the properties.LogonType log field value is equal to Batch, then the extensions.auth.mechanism UDM field is set to BATCH.
Else, if the properties.LogonType log field value is equal to Service, then the extensions.auth.mechanism UDM field is set to SERVICE.
Else, if the properties.LogonType log field value is equal to RemoteInteractive, then the extensions.auth.mechanism UDM field is set to REMOTE_INTERACTIVE.
Else, the extensions.auth.mechanism UDM field is set to MECHANISM_UNSPECIFIED and properties.LogonType is mapped to additional.fields[logon_type].
properties.Protocol network.ip_protocol If the properties.Protocol log field value is equal to Tcp, then the network.ip_protocol UDM field is set to TCP.

Else, if the properties.Protocol log field value is equal to Udp, then the network.ip_protocol UDM field is set to UDP.

Else, if the properties.Protocol log field value is equal to Icmp, then the network.ip_protocol UDM field is set to ICMP.

Else, the network.ip_protocol UDM field is set to UNKNOWN_IP_PROTOCOL and properties.Protocol is mapped to additional.fields[network_protocol].
properties.AccountDisplayName principal.user.user_display_name
properties.Location principal.location.name
properties.OSPlatform principal.asset.platform_software.platform If the properties.OSPlatform log field value matches the regular expression pattern (?i)macos, then the principal.asset.platform_software.platform UDM field is set to MAC.
Else, if the properties.OSPlatform log field value matches the regular expression pattern (?i)windows, then the principal.asset.platform_software.platform UDM field is set to WINDOWS.
Else, if the properties.OSPlatform log field value matches the regular expression pattern (?i)linux, then the principal.asset.platform_software.platform UDM field is set to LINUX.
properties.OSPlatform principal.asset.platform_software.platform_version
properties.DeviceType principal.asset.type If the properties.DeviceType log field value is equal to NetworkDevice, then the principal.asset.type UDM field is set to NETWORK_ATTACHED_STORAGE.
Else, if the properties.DeviceType log field value is equal to Workstation, then the principal.asset.type UDM field is set to WORKSTATION.
Else, if the properties.DeviceType log field value is equal to Server, then the principal.asset.type UDM field is set to SERVER.
Else, if the properties.DeviceType log field value is equal to Mobile, then the principal.asset.type UDM field is set to MOBILE.
Else if the properties.DeviceType log field value is equal to Printer, then the principal.asset.type UDM field is set to PRINTER.
Else, the principal.asset.type UDM field is set to ROLE_UNSPECIFIED and properties.DeviceType is mapped to principal.asset.attribute.labels[device_type].
properties.ISP network.carrier_name
properties.DestinationDeviceName intermediary.hostname
properties.TargetDeviceName target.hostname
properties.FailureReason security_result.description
properties.Port principal.port
properties.DestinationPort intermediary.port
properties.DestinationIPAddress intermediary.ip
properties.TargetAccountDisplayName target.user.user_display_name
properties.Application principal.application
metadata.event_type The metadata.event_type UDM field is set to USER_LOGIN.
properties.DeviceName principal.hostname If the properties.DeviceName log field value is not empty, then the properties.DeviceName log field is mapped to the principal.hostname UDM field.
properties.IPAddress principal.ip If the properties.IPAddress log field value is not empty, then the properties.IPAddress log field is mapped to the principal.asset.ip UDM field.
properties.AccountDomain principal.administrative_domain
properties.AdditionalFields additional.fields[additionalfields]
properties.AccountObjectId principal.user.product_object_id
properties.AccountUpn principal.user.email_addresses
properties.AccountName principal.user.userid
properties.AccountSid principal.user.windows_sid
properties.Timestamp metadata.event_timestamp
properties.ReportId metadata.product_log_id

필드 매핑 참조: MICROSOFT DEFENDER ENDPOINT - DeviceLogonEvents

다음 표에는 DeviceLogonEvents 로그 유형의 로그 필드와 해당 UDM 필드가 나와 있습니다.

Log field UDM mapping Logic
properties.InitiatingProcessSessionId additional.fields[initiating_process_session_id]
properties.IsInitiatingProcessRemoteSession additional.fields[is_initiating_process_remote_session]
properties.InitiatingProcessRemoteSessionDeviceName src.hostname
properties.InitiatingProcessRemoteSessionIP src.ip
properties.LogonType extensions.auth.mechanism If the properties.LogonType log field value is equal to Interactive, then the extensions.auth.mechanism UDM field is set to INTERACTIVE.

Else, if the properties.LogonType log field value is equal to Network, then the extensions.auth.mechanism UDM field is set to NETWORK.

Else, if the properties.LogonType log field value is equal to Batch, then the extensions.auth.mechanism UDM field is set to BATCH.

Else, if the properties.LogonType log field value is equal to Service, then the extensions.auth.mechanism UDM field is set to SERVICE.

Else, if the properties.LogonType log field value is equal to CachedInteractive, then the extensions.auth.mechanism UDM field is set to CACHED_INTERACTIVE.

Else, if the properties.LogonType log field value is equal to CachedRemoteInteractive, then the extensions.auth.mechanism UDM field is set to CACHED_REMOTE_INTERACTIVE.

Else, if the properties.LogonType log field value is equal to NetworkCleartext, then the extensions.auth.mechanism UDM field is set to NETWORK_CLEAR_TEXT.

Else, if the properties.LogonType log field value is equal to NewCredentials, then the extensions.auth.mechanism UDM field is set to NEW_CREDENTIALS.

Else, if the properties.LogonType log field value is equal to Local, then the extensions.auth.mechanism UDM field is set to LOCAL.

Else, if the properties.LogonType log field value is equal to Unlock, then the extensions.auth.mechanism UDM field is set to UNLOCK.

Else, if the properties.LogonType log field value is equal to RemoteInteractive, then the extensions.auth.mechanism UDM field is set to REMOTE_INTERACTIVE.

Else, the extensions.auth.mechanism UDM field is set to MECHANISM_UNSPECIFIED.
properties.Timestamp metadata.event_timestamp
metadata.event_type The metadata.event_type UDM field is set to USER_LOGIN.
properties.ReportId metadata.product_log_id
properties.Protocol network.ip_protocol If the properties.Protocol log field value is equal to Tcp, then the network.ip_protocol UDM field is set to TCP.

If the properties.Protocol log field value is equal to Udp, then the network.ip_protocol UDM field is set to UDP.

If the properties.Protocol log field value is equal to Icmp, then the network.ip_protocol UDM field is set to ICMP.
properties.LogonId extensions.auth.auth_details
properties.InitiatingProcessAccountDomain principal.administrative_domain
properties.DeviceId target.asset_id The target.asset_id is set to DeviceID:%{properties.DeviceId}.
properties.DeviceName target.hostname
properties.InitiatingProcessCommandLine principal.process.command_line
properties.InitiatingProcessFolderPath principal.process.file.full_path If the properties.InitiatingProcessFolderPath log field value matches the regular expression pattern the properties.InitiatingProcessFileName log field value, then the properties.InitiatingProcessFolderPath log field is mapped to the principal.process.file.full_path UDM field.

Else, the principal.process.file.full_path is set to %{properties.InitiatingProcessFolderPath}/%{properties.InitiatingProcessFileName}.
properties.InitiatingProcessMD5 principal.process.file.md5 If the properties.InitiatingProcessMD5 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.InitiatingProcessMD5 log field is mapped to the principal.process.file.md5 UDM field.
properties.InitiatingProcessFileName principal.process.file.names
properties.InitiatingProcessSHA1 principal.process.file.sha1 If the properties.InitiatingProcessSHA1 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.InitiatingProcessSHA1 log field is mapped to the principal.process.file.sha1 UDM field.
properties.InitiatingProcessSHA256 principal.process.file.sha256 If the properties.InitiatingProcessSHA256 log field value matches the regular expression pattern ^[a-f0-9]{64}$, then the properties.InitiatingProcessSHA256 log field is mapped to the principal.process.file.sha256 UDM field.
properties.InitiatingProcessFileSize principal.process.file.size
properties.InitiatingProcessParentFileName principal.process.parent_process.file.names
properties.InitiatingProcessParentId principal.process.parent_process.pid
properties.InitiatingProcessId principal.process.pid
properties.InitiatingProcessTokenElevation principal.process.token_elevation_type If the properties.InitiatingProcessTokenElevation log field value is equal to TokenElevationTypeFull, then the principal.process.token_elevation_type UDM field is set to TYPE_1.

Else, if the properties.InitiatingProcessTokenElevation log field value is equal to TokenElevationTypeDefault, then the principal.process.token_elevation_type UDM field is set to TYPE_2.

Else, if the properties.InitiatingProcessTokenElevation log field value is equal to TokenElevationTypeLimited, then the principal.process.token_elevation_type UDM field is set to TYPE_3.
properties.InitiatingProcessAccountObjectId principal.user.product_object_id
properties.InitiatingProcessAccountUpn principal.user.user_display_name
properties.InitiatingProcessAccountName principal.user.userid
properties.InitiatingProcessAccountSid principal.user.windows_sid
properties.FailureReason security_result.description
properties.AccountDomain target.administrative_domain
properties.RemoteDeviceName principal.hostname
properties.RemoteIP principal.ip
properties.RemotePort principal.port
properties.IsLocalAdmin target.resource.attribute.labels[is_local_admin]
properties.AccountName target.user.userid
properties.AccountSid target.user.windows_sid
properties.RemoteIPType additional.fields[remote_ip_type]
properties.AdditionalFields additional.fields[additional_fields]
properties.AppGuardContainerId additional.fields[app_guard_container_id]
properties.InitiatingProcessCreationTime additional.fields[initiating_process_creation_time]
properties.InitiatingProcessIntegrityLevel additional.fields[initiating_process_integrity_level]
properties.InitiatingProcessVersionInfoCompanyName principal.process.file.exif_info.company
properties.InitiatingProcessVersionInfoFileDescription principal.process.file.exif_info.file_description
properties.InitiatingProcessVersionInfoInternalFileName additional.fields[initiating_process_version_info_internal_file_name]
properties.InitiatingProcessVersionInfoOriginalFileName principal.process.file.exif_info.original_file
properties.InitiatingProcessVersionInfoProductName principal.process.file.exif_info.product
properties.InitiatingProcessVersionInfoProductVersion additional.fields[initiating_process_version_info_product_version]
properties.InitiatingProcessParentCreationTime additional.fields[initiating_process_parent_creation_time]

필드 매핑 참조: MICROSOFT DEFENDER ENDPOINT - DeviceNetworkEvents

다음 표에는 DeviceNetworkEvents 로그 유형의 로그 필드와 해당 UDM 필드가 나와 있습니다.

Log field UDM mapping Logic
properties.ActionType security_result.summary
properties.InitiatingProcessSessionId additional.fields[initiating_process_session_id]
properties.IsInitiatingProcessRemoteSession additional.fields[is_initiating_process_remote_session]
properties.InitiatingProcessRemoteSessionDeviceName src.hostname
properties.InitiatingProcessRemoteSessionIP src.ip
properties.Timestamp metadata.event_timestamp
metadata.event_type The metadata.event_type UDM field is set to NETWORK_CONNECTION.
properties.ReportId metadata.product_log_id
properties.Protocol network.ip_protocol If the properties.Protocol log field value is equal to Tcp, then the network.ip_protocol UDM field is set to TCP.

Else, if the properties.Protocol log field value is equal to Udp, then the network.ip_protocol UDM field is set to UDP.

Else, if the properties.Protocol log field value is equal to Icmp, then the network.ip_protocol UDM field is set to ICMP.
properties.InitiatingProcessAccountDomain principal.administrative_domain
properties.DeviceId principal.asset_id The principal.asset_id is set to DeviceID:%{properties.DeviceId}.
properties.DeviceName principal.hostname
properties.LocalIP principal.ip
properties.LocalPort principal.port
properties.InitiatingProcessCommandLine principal.process.command_line
properties.InitiatingProcessFolderPath principal.process.file.full_path If the properties.InitiatingProcessFolderPath log field value matches the regular expression pattern the properties.InitiatingProcessFileName log field value, then the properties.InitiatingProcessFolderPath log field is mapped to the principal.process.file.full_path UDM field.

Else, the principal.process.file.full_path is set to %{properties.InitiatingProcessFolderPath}/%{properties.InitiatingProcessFileName}.
properties.InitiatingProcessMD5 principal.process.file.md5 If the properties.InitiatingProcessMD5 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.InitiatingProcessMD5 log field is mapped to the principal.process.file.md5 UDM field.
properties.InitiatingProcessFileName principal.process.file.names
properties.InitiatingProcessSHA1 principal.process.file.sha1 If the properties.InitiatingProcessSHA1 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.InitiatingProcessSHA1 log field is mapped to the principal.process.file.sha1 UDM field.
properties.InitiatingProcessSHA256 principal.process.file.sha256 If the properties.InitiatingProcessSHA256 log field value matches the regular expression pattern ^[a-f0-9]{64}$, then the properties.InitiatingProcessSHA256 log field is mapped to the principal.process.file.sha256 UDM field.
properties.InitiatingProcessFileSize principal.process.file.size
properties.InitiatingProcessParentFileName principal.process.parent_process.file.names
properties.InitiatingProcessParentId principal.process.parent_process.pid
properties.InitiatingProcessId principal.process.pid
properties.InitiatingProcessTokenElevation principal.process.token_elevation_type If the properties.InitiatingProcessTokenElevation log field value is equal to TokenElevationTypeFull, then the principal.process.token_elevation_type UDM field is set to TYPE_1.

Else, if the properties.InitiatingProcessTokenElevation log field value is equal to TokenElevationTypeDefault, then the principal.process.token_elevation_type UDM field is set to TYPE_2.

Else, if the properties.InitiatingProcessTokenElevation log field value is equal to TokenElevationTypeLimited, then the principal.process.token_elevation_type UDM field is set to TYPE_3.
properties.InitiatingProcessAccountObjectId principal.user.product_object_id
properties.InitiatingProcessAccountUpn principal.user.user_display_name
properties.InitiatingProcessAccountName principal.user.userid
properties.InitiatingProcessAccountSid principal.user.windows_sid
properties.RemoteIP target.ip
properties.RemotePort target.port
properties.RemoteUrl target.url
properties.LocalIPType additional_fields[LocalIPType]
properties.RemoteIPType additional_fields[RemoteIPType]
properties.AdditionalFields additional.fields[additional_fields]
properties.AppGuardContainerId additional.fields[app_guard_container_id]
properties.InitiatingProcessCreationTime additional.fields[initiating_process_creation_time]
properties.InitiatingProcessIntegrityLevel additional.fields[initiating_process_integrity_level]
properties.InitiatingProcessParentCreationTime additional.fields[initiating_process_parent_creation_time]
properties.InitiatingProcessVersionInfoCompanyName principal.process.file.exif_info.company
properties.InitiatingProcessVersionInfoFileDescription principal.process.file.exif_info.file_description
properties.InitiatingProcessVersionInfoInternalFileName additional.fields[initiating_process_version_info_internal_file_name]
properties.InitiatingProcessVersionInfoOriginalFileName principal.process.file.exif_info.original_file
properties.InitiatingProcessVersionInfoProductName principal.process.file.exif_info.product
properties.InitiatingProcessVersionInfoProductVersion additional.fields[initiating_process_version_info_product_version]

필드 매핑 참조: MICROSOFT DEFENDER ENDPOINT - DeviceNetworkInfo

다음 표에는 DeviceNetworkInfo 로그 유형의 로그 필드와 해당 UDM 필드가 나와 있습니다.

Log field UDM mapping Logic
properties.NetworkAdapterDnsSuffix entity.asset.attribute.labels[network_adapter_dns_suffix]
properties.OnboardingStatus entity.asset.attribute.labels[onboarding_status]
properties.DeviceId entity.asset_id The entity.asset_id is set to DeviceID:%{properties.DeviceId}.
properties.DeviceId entity.asset.asset_id The entity.asset.asset_id is set to DeviceID:%{properties.DeviceId}.
properties.ReportId entity.asset.attribute.labels[report_id]
properties.ConnectedNetworks entity.asset.attribute.labels[connected_networks]
properties.MacAddress entity.asset.mac
properties.NetworkAdapterName entity.asset.attribute.labels[network_adapter_name]
properties.NetworkAdapterStatus entity.asset.attribute.labels[network_adapter_status]
properties.NetworkAdapterType entity.asset.attribute.labels[network_adapter_type]
properties.NetworkAdapterVendor entity.asset.attribute.labels[network_adapter_vendor]
properties.TunnelType entity.asset.attribute.labels[tunnel_type]
properties.DefaultGateways entity.asset.attribute.labels[default_gateways]
properties.DeviceName entity.asset.hostname
properties.IPAddresses entity.asset.ip
entity.asset.type The entity.asset.type UDM field is set to WORKSTATION.
properties.DnsAddresses entity.domain.last_dns_records.type The entity.domain.last_dns_records.type UDM field is set to ip_address.
properties.DnsAddresses entity.domain.last_dns_records.value The properties.DnsAddresses log field is mapped to the entity.domain.last_dns_records.value UDM field.
properties.IPv4Dhcp entity.network.dhcp.ciaddr If the properties.IPv4Dhcp log field value is not empty, then the properties.IPv4Dhcp log field is mapped to the entity.network.dhcp.ciaddr UDM field.

Else, the properties.IPv6Dhcp log field is mapped to the entity.network.dhcp.ciaddr UDM field.
properties.Timestamp metadata.creation_time
metadata.entity_type The metadata.entity_type UDM field is set to ASSET.
properties.DeviceId metadata.product_entity_id The metadata.product_entity_id is set to DeviceID:%{properties.DeviceId}.

필드 매핑 참조: MICROSOFT DEFENDER ENDPOINT - DeviceProcessEvents

다음 표에는 DeviceProcessEvents 로그 유형의 로그 필드와 해당 UDM 필드가 나와 있습니다.

Log field UDM mapping Logic
properties.InitiatingProcessSessionId additional.fields[initiating_process_session_id]
properties.IsInitiatingProcessRemoteSession additional.fields[is_initiating_process_remote_session]
properties.InitiatingProcessRemoteSessionDeviceName src.hostname If properties.InitiatingProcessRemoteSessionDeviceName log field is not empty, then properties.InitiatingProcessRemoteSessionDeviceName log field is mapped to src.hostname UDM field.
properties.ProcessRemoteSessionDeviceName src.hostname If properties.InitiatingProcessRemoteSessionDeviceName log field is empty, then properties.ProcessRemoteSessionDeviceName log field is mapped to src.hostname UDM field.
properties.InitiatingProcessRemoteSessionIP src.ip
properties.ProcessRemoteSessionIP src.ip
properties.CreatedProcessSessionId additional.fields[created_process_session_id]
properties.IsProcessRemoteSession additional.fields[is_process_remote_session]
properties.Timestamp metadata.event_timestamp
properties.ActionType metadata.event_type If the properties.ActionType log field value matches the regular expression pattern (?i)ProcessCreated, then the metadata.event_type UDM field is set to PROCESS_LAUNCH.

Else, if the properties.ActionType log field value matches the regular expression pattern (?i)OpenProcess, then the metadata.event_type UDM field is set to PROCESS_OPEN.
properties.ReportId metadata.product_log_id
properties.LogonId network.session_id
properties.InitiatingProcessAccountDomain principal.administrative_domain
properties.DeviceId principal.asset_id The principal.asset_id is set to DeviceID:%{properties.DeviceId}.
properties.DeviceName principal.hostname
properties.InitiatingProcessCommandLine principal.process.command_line
properties.InitiatingProcessFolderPath principal.process.file.full_path If the properties.InitiatingProcessFolderPath log field value matches the regular expression pattern the properties.InitiatingProcessFileName log field value, then the properties.InitiatingProcessFolderPath log field is mapped to the principal.process.file.full_path UDM field.

Else, the principal.process.file.full_path is set to %{properties.InitiatingProcessFolderPath}/%{properties.InitiatingProcessFileName}.
properties.InitiatingProcessMD5 principal.process.file.md5 If the properties.InitiatingProcessMD5 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.InitiatingProcessMD5 log field is mapped to the principal.process.file.md5 UDM field.
properties.InitiatingProcessFileName principal.process.file.names
properties.InitiatingProcessSHA1 principal.process.file.sha1 If the properties.InitiatingProcessSHA1 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.InitiatingProcessSHA1 log field is mapped to the principal.process.file.sha1 UDM field.
properties.InitiatingProcessSHA256 principal.process.file.sha256 If the properties.InitiatingProcessSHA256 log field value matches the regular expression pattern ^[a-f0-9]{64}$, then the properties.InitiatingProcessSHA256 log field is mapped to the principal.process.file.sha256 UDM field.
properties.InitiatingProcessSignatureStatus principal.process.file.signature_info.sigcheck.signers.status
properties.InitiatingProcessFileSize principal.process.file.size
properties.InitiatingProcessParentId principal.process.parent_process.pid
properties.InitiatingProcessParentFileName principal.process.parent_process.file.names
properties.InitiatingProcessId principal.process.pid
properties.InitiatingProcessTokenElevation principal.process.token_elevation_type If the properties.InitiatingProcessTokenElevation log field value is equal to TokenElevationTypeFull, then the principal.process.token_elevation_type UDM field is set to TYPE_1.

Else, if the properties.InitiatingProcessTokenElevation log field value is equal to TokenElevationTypeDefault, then the principal.process.token_elevation_type UDM field is set to TYPE_2.

Else, if the properties.InitiatingProcessTokenElevation log field value is equal to TokenElevationTypeLimited, then the principal.process.token_elevation_type UDM field is set to TYPE_3
properties.InitiatingProcessAccountObjectId principal.user.product_object_id
properties.InitiatingProcessAccountUpn principal.user.user_display_name
properties.InitiatingProcessAccountName principal.user.userid
properties.InitiatingProcessAccountSid principal.user.windows_sid
properties.AccountDomain target.administrative_domain
properties.FolderPath target.file.full_path If the properties.FolderPath log field value matches the regular expression pattern the properties.FileName log field value, then the properties.FolderPath log field is mapped to the target.file.full_path UDM field.

Else, the target.file.full_path set to %{properties.FolderPath}/%{properties.FileName}.
properties.MD5 target.process.file.md5 If the properties.MD5 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.MD5 log field is mapped to the target.file.md5 UDM field.
properties.FileName target.process.file.names
properties.SHA1 target.process.file.sha1 If the properties.SHA1 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.SHA1 log field is mapped to the target.file.sha1 UDM field.
properties.SHA256 target.process.file.sha256 If the properties.SHA256 log field value matches the regular expression pattern ^[a-f0-9]{64}$, then the properties.SHA256 log field is mapped to the target.file.sha256 UDM field.
properties.FileSize target.process.file.size
properties.ProcessCommandLine target.process.command_line
properties.ProcessId target.process.pid
properties.ProcessTokenElevation target.process.token_elevation_type If the properties.ProcessTokenElevation log field value is equal to TokenElevationTypeFull, then the target.process.token_elevation_type UDM field is set to TYPE_1.

Else, if the properties.ProcessTokenElevation log field value is equal to TokenElevationTypeDefault, then the target.process.token_elevation_type UDM field is set to TYPE_2.

Else, if the properties.ProcessTokenElevation log field value is equal to TokenElevationTypeLimited, then the target.process.token_elevation_type UDM field is set to TYPE_3.
properties.ProcessIntegrityLevel target.resource.attribute.labels[process_integrity_level]
properties.AccountUpn target.user.user_display_name
properties.AccountName target.user.userid
properties.AccountSid target.user.windows_sid
properties.InitiatingProcessCreationTime additional.fields[initiating_process_creation_time]
properties.InitiatingProcessParentCreationTime additional.fields[initiating_process_parent_creation_time]
properties.AccountObjectId additional.fields[account_object_id]
properties.AdditionalFields additional.fields[additional_fields]
properties.AppGuardContainerId additional.fields[app_guard_container_id]
properties.InitiatingProcessIntegrityLevel additional.fields[initiating_process_integrity_level]
properties.InitiatingProcessLogonId additional.fields[initiating_process_logon_id]
properties.InitiatingProcessSignerType additional.fields[initiating_process_signer_type]
properties.InitiatingProcessVersionInfoCompanyName principal.process.file.exif_info.company
properties.InitiatingProcessVersionInfoFileDescription principal.process.file.exif_info.file_description
properties.InitiatingProcessVersionInfoInternalFileName additional.fields[initiating_process_version_info_internal_file_name]
properties.InitiatingProcessVersionInfoOriginalFileName principal.process.file.exif_info.original_file
properties.InitiatingProcessVersionInfoProductName principal.process.file.exif_info.product
properties.InitiatingProcessVersionInfoProductVersion additional.fields[initiating_process_version_info_product_version]
properties.ProcessCreationTime additional.fields[process_creation_time]
properties.ProcessVersionInfoCompanyName target.process.file.exif_info.company
properties.ProcessVersionInfoFileDescription target.process.file.exif_info.file_description
properties.ProcessVersionInfoInternalFileName additional.fields[process_version_info_internal_file_name]
properties.ProcessVersionInfoOriginalFileName target.process.file.exif_info.original_file
properties.ProcessVersionInfoProductName target.process.file.exif_info.product
properties.ProcessVersionInfoProductVersion additional.fields[process_version_info_product_version]

필드 매핑 참조: MICROSOFT DEFENDER ENDPOINT - DeviceTvmInfoGathering

다음 표에는 DeviceTvmInfoGathering 로그 유형의 로그 필드와 해당 UDM 필드가 나와 있습니다.

Log field UDM mapping Logic
properties.Timestamp metadata.event_timestamp
metadata.event_type The metadata.event_type UDM field is set to SCAN_HOST.
properties.DeviceId principal.asset_id The principal.asset_id is set to DeviceID:%{properties.DeviceId}.
properties.OSPlatform principal.asset.platform_software.platform If the properties.OSPlatform log field value matches the regular expression pattern (?i)macos, then the principal.asset.platform_software.platform UDM field is set to MAC.

Else, if the properties.OSPlatform log field value matches the regular expression pattern (?i)windows, then the principal.asset.platform_software.platform UDM field is set to WINDOWS.

Else, if the properties.OSPlatform log field value matches the regular expression pattern (?i)linux, then the principal.asset.platform_software.platform UDM field is set to LINUX.
properties.OSPlatform principal.asset.platform_software.platform_version
properties.DeviceName principal.hostname
properties.LastSeenTime principal.asset.last_discover_time
properties.AdditionalFields additional.fields[additional_fields]

필드 매핑 참조: MICROSOFT DEFENDER ENDPOINT - DeviceRegistryEvents

다음 표에는 DeviceRegistryEvents 로그 유형의 로그 필드와 해당 UDM 필드가 나와 있습니다.

Log field UDM mapping Logic
properties.InitiatingProcessSessionId additional.fields[initiating_process_session_id]
properties.IsInitiatingProcessRemoteSession additional.fields[is_initiating_process_remote_session]
properties.InitiatingProcessRemoteSessionDeviceName src.hostname
properties.InitiatingProcessRemoteSessionIP src.ip
properties.Timestamp metadata.event_timestamp
properties.ActionType metadata.event_type If the properties.ActionType log field value matches the regular expression pattern (?i)RegistryKeyCreated, then the metadata.event_type UDM field is set to REGISTRY_CREATION.

Else, if the properties.ActionType log field value matches the regular expression pattern (?i)RegistryKeyDeleted, then the metadata.event_type UDM field is set to REGISTRY_DELETION.

Else, if the properties.ActionType log field value matches the regular expression pattern (?i)RegistryKeyRenamed, then the metadata.event_type UDM field is set to REGISTRY_MODIFICATION.

Else, if the properties.ActionType log field value matches the regular expression pattern (?i)RegistryValueDeleted, then the metadata.event_type UDM field is set to REGISTRY_DELETION.

Else, if the properties.ActionType log field value matches the regular expression pattern (?i)RegistryValueSet, then the metadata.event_type UDM field is set to REGISTRY_MODIFICATION.

Else, the metadata.event_type UDM field is set to REGISTRY_UNCATEGORIZED.
properties.ReportId metadata.product_log_id
properties.InitiatingProcessAccountDomain principal.administrative_domain
properties.DeviceId principal.asset_id The principal.asset_id is set to DeviceID:%{properties.DeviceId}.
properties.DeviceName principal.hostname
properties.InitiatingProcessCommandLine principal.process.command_line
properties.InitiatingProcessFolderPath principal.process.file.full_path If the properties.InitiatingProcessFolderPath log field value matches the regular expression pattern the properties.InitiatingProcessFileName log field value, then the properties.InitiatingProcessFolderPath log field is mapped to the principal.process.file.full_path UDM field.

Else, the principal.process.file.full_path is set to %{properties.InitiatingProcessFolderPath}/%{properties.InitiatingProcessFileName}.
properties.InitiatingProcessMD5 principal.process.file.md5 If the properties.InitiatingProcessMD5 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.InitiatingProcessMD5 log field is mapped to the principal.process.file.md5 UDM field.
properties.InitiatingProcessFileName principal.process.file.names
properties.InitiatingProcessSHA1 principal.process.file.sha1 If the properties.InitiatingProcessSHA1 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.InitiatingProcessSHA1 log field is mapped to the principal.process.file.sha1 UDM field.
properties.InitiatingProcessSHA256 principal.process.file.sha256 If the properties.InitiatingProcessSHA256 log field value matches the regular expression pattern ^[a-f0-9]{64}$, then the properties.InitiatingProcessSHA256 log field is mapped to the principal.process.file.sha256 UDM field.
properties.InitiatingProcessFileSize principal.process.file.size
properties.InitiatingProcessParentFileName principal.process.parent_process.file.names
properties.InitiatingProcessParentId principal.process.parent_process.pid
properties.InitiatingProcessId principal.process.pid
properties.PreviousRegistryValueData src.registry.registry_value_data
properties.PreviousRegistryKey src.registry.registry_key
properties.PreviousRegistryValueName src.registry.registry_value_name
properties.InitiatingProcessAccountObjectId principal.user.attribute.labels[initiating_process_account_object_id]
properties.InitiatingProcessAccountUpn principal.user.attribute.labels[initiating_process_account_upn]
properties.InitiatingProcessAccountName principal.user.userid
properties.InitiatingProcessAccountSid principal.user.windows_sid
properties.InitiatingProcessTokenElevation principal.process.token_elevation_type If the properties.InitiatingProcessTokenElevation log field value is equal to TokenElevationTypeFull, then the principal.process.token_elevation_type UDM field is set to TYPE_1.

Else, if the properties.InitiatingProcessTokenElevation log field value is equal to TokenElevationTypeDefault, then the principal.process.token_elevation_type UDM field is set to TYPE_2.

Else, if the properties.InitiatingProcessTokenElevation log field value is equal to TokenElevationTypeLimited, then the principal.process.token_elevation_type UDM field is set to TYPE_3.
properties.RegistryValueData target.registry.registry_value_data
properties.RegistryKey target.registry.registry_key
properties.RegistryValueName target.registry.registry_value_name
properties.InitiatingProcessCreationTime additional.fields[initiating_process_creation_time]
properties.InitiatingProcessIntegrityLevel additional.fields[initiating_process_integrity_level]
properties.InitiatingProcessParentCreationTime additional.fields[initiating_process_parent_creation_time]
properties.AppGuardContainerId additional.fields[app_guard_container_id]
properties.InitiatingProcessVersionInfoCompanyName principal.process.file.exif_info.company
properties.InitiatingProcessVersionInfoFileDescription principal.process.file.exif_info.file_description
properties.InitiatingProcessVersionInfoInternalFileName additional.fields[initiating_process_version_info_internal_file_name]
properties.InitiatingProcessVersionInfoOriginalFileName principal.process.file.exif_info.original_file
properties.InitiatingProcessVersionInfoProductName principal.process.file.exif_info.product
properties.InitiatingProcessVersionInfoProductVersion additional.fields[initiating_process_version_info_product_version]
properties.RegistryValueType additional.fields[registry_value_type]

필드 매핑 참조: MICROSOFT DEFENDER ENDPOINT - DeviceTvmInfoGatheringKB

다음 표에는 DeviceTvmInfoGatheringKB 로그 유형의 로그 필드와 해당 UDM 필드가 나와 있습니다.

Log field UDM mapping Logic
properties.Description metadata.description
metadata.event_type The metadata.event_type UDM field is set to GENERIC_EVENT.
properties.IgId metadata.product_log_id
properties.Categories principal.resource.attribute.labels[categories]
properties.DataStructure principal.resource.attribute.labels[data_structure]
properties.FieldName principal.resource.name

필드 매핑 참조: MICROSOFT DEFENDER ENDPOINT - DeviceTvmSecureConfigurationAssessment

다음 표에는 DeviceTvmSecureConfigurationAssessment 로그 유형의 로그 필드와 해당 UDM 필드가 나와 있습니다.

Log field UDM mapping Logic
properties.Timestamp metadata.event_timestamp
metadata.event_type The metadata.event_type UDM field is set to SCAN_UNCATEGORIZED.
properties.DeviceId principal.asset_id The principal.asset_id is set to DeviceID:%{properties.DeviceId}.
properties.OSPlatform principal.asset.platform_software.platform If the properties.OSPlatform log field value matches the regular expression pattern (?i)macos, then the prinipal.asset.platform_software.platform UDM field is set to MAC.

Else, if the properties.OSPlatform log field value matches the regular expression pattern (?i)windows, then the principal.asset.platform_software.platform UDM field is set to WINDOWS.

Else, if the properties.OSPlatform log field value matches the regular expression pattern (?i)linux, then the principal.asset.platform_software.platform UDM field is set to LINUX.
properties.DeviceName principal.hostname
properties.ConfigurationCategory principal.resource.attribute.labels[configuration_category]
properties.ConfigurationImpact principal.resource.attribute.labels[configuration_impact]
properties.Context principal.resource.attribute.labels[contex]
properties.IsApplicable principal.resource.attribute.labels[is_applicable]
properties.IsCompliant principal.resource.attribute.labels[is_compliant]
properties.IsExpectedUserImpact principal.resource.attribute.labels[is_expected_user_impact]
properties.ConfigurationId principal.resource.product_object_id
properties.ConfigurationSubcategory principal.resource.resource_subtype
principal.resource.resource_type The principal.resource.resource_type UDM field is set to ACCESS_POLICY.

필드 매핑 참조: MICROSOFT DEFENDER ENDPOINT - DeviceTvmSecureConfigurationAssessmentKB

다음 표에는 DeviceTvmSecureConfigurationAssessmentKB 로그 유형의 로그 필드와 해당 UDM 필드가 나와 있습니다.

Log field UDM mapping Logic
metadata.event_type The metadata.event_type UDM field is set to GENERIC_EVENT.
properties.ConfigurationBenchmarks principal.resource.attribute.labels[configuration_benchmarks]
properties.ConfigurationCategory principal.resource.attribute.labels[configuration_category]
properties.ConfigurationDescription principal.resource.attribute.labels[configuration_description]
properties.ConfigurationImpact principal.resource.attribute.labels[configuration_impact]
properties.RemediationOptions principal.resource.attribute.labels[remediation_options]
properties.RiskDescription principal.resource.attribute.labels[risk_description]
properties.Tags principal.resource.attribute.labels[tags]
properties.ConfigurationName principal.resource.name
properties.ConfigurationId principal.resource.product_object_id
properties.ConfigurationSubcategory principal.resource.resource_subtype
principal.resource.resource_type The principal.resource.resource_type UDM field is set to ACCESS_POLICY.

필드 매핑 참조: MICROSOFT DEFENDER ENDPOINT - DeviceTvmSoftwareEvidenceBeta

다음 표에는 DeviceTvmSoftwareEvidenceBeta 로그 유형의 로그 필드와 해당 UDM 필드가 나와 있습니다.

Log field UDM mapping Logic
metadata.event_type The metadata.event_type UDM field is set to GENERIC_EVENT.
properties.DeviceId principal.asset_id The principal.asset_id is set to DeviceID:%{properties.DeviceId}.
properties.DiskPaths principal.asset.attribute.labels[disk_paths] The properties.DiskPaths log field is mapped to the principal.asset.attribute.labels.disk_paths UDM field.
properties.RegistryPaths principal.asset.attribute.labels[registry_paths] The properties.RegistryPaths log field is mapped to the principal.asset.attribute.labels.registry_paths UDM field.
properties.LastSeenTime principal.asset.last_discover_time
properties.SoftwareName principal.asset.software.name
properties.SoftwareVendor principal.asset.software.vendor_name
properties.SoftwareVersion principal.asset.software.version

필드 매핑 참조: MICROSOFT DEFENDER ENDPOINT - DeviceTvmSoftwareInventory

다음 표에는 DeviceTvmSoftwareInventory 로그 유형의 로그 필드와 해당 UDM 필드가 나와 있습니다.

Log field UDM mapping Logic
metadata.event_type The metadata.event_type UDM field is set to GENERIC_EVENT.
properties.DeviceId principal.asset_id The principal.asset_id is set to DeviceID:%{properties.DeviceId}.
properties.EndOfSupportDate principal.asset.attribute.labels[end_of_support_date]
properties.EndOfSupportStatus principal.asset.attribute.labels[end_of_support_status]
properties.OSArchitecture principal.asset.attribute.labels[os_architecture]
properties.ProductCodeCpe principal.asset.attribute.labels[product_code_cpe]
properties.OSPlatform principal.asset.platform_software.platform If the properties.OSPlatform log field value matches the regular expression pattern (?i)macos, then the prinipal.asset.platform_software.platform UDM field is set to MAC.

Else, if the properties.OSPlatform log field value matches the regular expression pattern (?i)windows, then the principal.asset.platform_software.platform UDM field is set to WINDOWS.

Else, if the properties.OSPlatform log field value matches the regular expression pattern (?i)linux, then the principal.asset.platform_software.platform UDM field is set to LINUX.
properties.OSVersion principal.asset.platform_software.platform_version
properties.SoftwareName principal.asset.software.name
properties.SoftwareVendor principal.asset.software.vendor_name
properties.SoftwareVersion principal.asset.software.version
properties.DeviceName principal.hostname

필드 매핑 참조: MICROSOFT DEFENDER ENDPOINT - DeviceTvmSoftwareVulnerabilities

다음 표에는 DeviceTvmSoftwareVulnerabilities 로그 유형의 로그 필드와 해당 UDM 필드가 나와 있습니다.

Log field UDM mapping Logic
properties.CveId extensions.vulns.vulnerabilities.cve_id
properties.VulnerabilityLevel extensions.vulns.vulnerabilities.severity If the properties.VulnerabilityLevel log field value is equal to High, then the extensions.vulns.vulnerabilities.severity UDM field is set to HIGH.

Else, if the properties.VulnerabilityLevel log field value is equal to Medium, then the extensions.vulns.vulnerabilities.severity UDM field is set to MEDIUM.

Else, if the properties.VulnerabilityLevel log field value is equal to Low, then the extensions.vulns.vulnerabilities.severity UDM field is set to LOW.

Else, if the properties.VulnerabilityLevel log field value is equal to Informational, then the extensions.vulns.vulnerabilities.severity UDM field is set to INFORMATIONAL.
properties.SeverityLevel extensions.vulns.vulnerablitities.severity_details
metadata.event_type The metadata.event_type UDM field is set to SCAN_VULN_HOST.
properties.DeviceId principal.asset_id The principal.asset_id is set to DeviceID:%{properties.DeviceId}.
properties.OSPlatform principal.asset.platform_software.platform If the properties.OSPlatform log field value matches the regular expression pattern (?i)macos, then the principal.asset.platform_software.platform UDM field is set to MAC.

Else, if the properties.OSPlatform log field value matches the regular expression pattern (?i)windows, then the principal.asset.platform_software.platform UDM field is set to WINDOWS.

Else, if the properties.OSPlatform log field value matches the regular expression pattern (?i)linux, then the principal.asset.platform_software.platform UDM field is set to LINUX.
properties.OSVersion principal.asset.platform_software.platform_version
properties.SoftwareName principal.asset.software.name
properties.SoftwareVendor principal.asset.software.vendor_name
properties.SoftwareVersion principal.asset.software.version
properties.DeviceName principal.hostname
properties.RecommendedSecurityUpdateId security_result.detection_fields[recommended_security_update_id]
properties.RecommendedSecurityUpdate security_result.detection_fields[recommended_security_update]
properties.CveTags additional.fields[cve_tags]

필드 매핑 참조: MICROSOFT DEFENDER ENDPOINT - DeviceTvmSoftwareVulnerabilitiesKB

다음 표에는 DeviceTvmSoftwareVulnerabilitiesKB 로그 유형의 로그 필드와 해당 UDM 필드가 나와 있습니다.

Log field UDM mapping Logic
metadata.event_type The metadata.event_type UDM field is set to GENERIC_EVENT.
properties.CveId extensions.vulns.vulnerabilities.cve_id
properties.CvssScore extensions.vulns.vulnerablities.cvss_base_score
properties.IsExploitAvailable additional.fields[is_exploit_available]
properties.VulnerabilitySeverityLevel extensions.vulns.vulnerabilities.severity If the properties.VulnerabilitySeverityLevel log field value is equal to High, then the extensions.vulns.vulnerabilities.severity UDM field is set to HIGH.

Else, if the properties.VulnerabilitySeverityLevel log field value is equal to Medium, then the extensions.vulns.vulnerabilities.severity UDM field is set to MEDIUM.

Else, if the properties.VulnerabilitySeverityLevel log field value is equal to Low, then the extensions.vulns.vulnerabilities.severity UDM field is set to LOW.

Else, if the properties.VulnerabilitySeverityLevel log field value is equal to Informational, then the extensions.vulns.vulnerabilities.severity UDM field is set to INFORMATIONAL.

Else, the extensions.vulns.vulnerabilities.severity UDM field is set to UNKNOWN_SEVERITY.
properties.VulnerabilitySeverityLevel extensions.vulns.vulnerablitities.severity_details
properties.LastModifiedTime additional.fields[last_modified_time]
properties.PublishedDate additional.fields[published_date]
properties.VulnerabilityDescription extensions.vulns.vulnerabilities.cve_description
properties.AffectedSoftware target.application

필드 매핑 참조: MICROSOFT DEFENDER ENDPOINT - EmailAttachmentInfo

다음 표에는 EmailAttachmentInfo 로그 유형의 로그 필드와 해당 UDM 필드가 나와 있습니다.

Log field UDM mapping Logic
properties.FileType target.file.mime_type
properties.FileName target.file.names
properties.SHA256 target.file.sha256 If the properties.SHA256 log field value matches the regular expression pattern ^[a-f0-9]{64}$, then the properties.SHA256 log field is mapped to the target.file.sha256 UDM field.
properties.FileSize target.file.size
properties.Timestamp metadata.event_timestamp
metadata.event_type The metadata.event_type UDM field is set to EMAIL_TRANSACTION.
properties.ReportId metadata.product_log_id
properties.SenderFromAddress network.email.from If the properties.SenderFromAddress log field value matches the regular expression pattern ^.+@.+$ and the length of the value is 256 characters or less, then the properties.SenderFromAddress log field is mapped to the network.email.from UDM field.

Else, the additional.fields.key UDM field is set to SenderFromAddress and the properties.SenderFromAddress log field value is mapped to the additional.fields.value.string_value UDM field.
properties.SenderFromAddress principal.user.email_addresses
properties.NetworkMessageId network.email.mail_id
properties.RecipientEmailAddress network.email.to If the properties.RecipientEmailAddress log field value matches the regular expression pattern ^.+@.+$ and the length of the value is 256 characters or less, then the properties.RecipientEmailAddress log field is mapped to the network.email.to UDM field.

Else, the additional.fields.key UDM field is set to RecipientEmailAddress and the properties.RecipientEmailAddress log field value is mapped to the additional.fields.value.string_value UDM field.
properties.RecipientEmailAddress target.user.email_addresses
properties.SenderObjectId principal.user.product_object_id
properties.SenderDisplayName principal.user.user_display_name
properties.ThreatTypes security_result.category If the properties.ThreatTypes log field value is equal to Phish, then the security_result.category UDM field is set to MAIL_PHISHING.

Else, if the properties.ThreatTypes log field value is equal to Malware, then the security_result.category UDM field is set to SOFTWARE_MALICIOUS.

Else, if the properties.ThreatTypes log field value is equal to Spam, then the security_result.category UDM field is set to MAIL_SPAM.

Else, the security_result.category UDM field is set to UNKNOWN_CATEGORY.
properties.ThreatTypes security_result.category_details
properties.DetectionMethods security_result.detection_fields[detection_methods]
properties.ThreatNames security_result.threat_name
properties.RecipientObjectId target.user.product_object_id

필드 매핑 참조: MICROSOFT DEFENDER ENDPOINT - EmailEvents

다음 표에는 EmailEvents 로그 유형의 로그 필드와 해당 UDM 필드가 나와 있습니다.

Log field UDM mapping Logic
properties.Timestamp metadata.event_timestamp
metadata.event_type The metadata.event_type UDM field is set to EMAIL_TRANSACTION.
properties.ReportId metadata.product_log_id
properties.EmailDirection network.direction If the properties.EmailDirection log field value is equal to Inbound, then the network.direction UDM field is set to INBOUND.

Else, if the properties.EmailDirection log field value is equal to Outbound, then the network.direction UDM field is set to OUTBOUND.

Else, the network.direction UDM field is set to UNKNOWN_DIRECTION, the additional.fields.key UDM field is set to EmailDirection, and the properties.EmailDirection log field value is mapped to the additional.fields.value.string_value UDM field.
properties.NetworkMessageId network.email.mail_id
properties.Subject network.email.subject
properties.RecipientEmailAddress network.email.to
properties.DistributionList network.email.to If the properties.DistributionList log field value matches the regular expression pattern ^.+@.+$ and the length of the value is 256 characters or less, then the properties.DistributionList log field is mapped to the network.email.to UDM field.

Else, the additional.fields.key UDM field is set to DistributionList and the properties.DistributionList log field value is mapped to the additional.fields.value.string_value UDM field.
properties.SenderFromDomain principal.administrative_domain
properties.SenderIPv4 principal.ip
properties.SenderIPv6 principal.ip
properties.SenderMailFromAddress network.email.reply_to
properties.SenderFromAddress network.email.from If the properties.SenderFromAddress log field value matches the regular expression pattern ^.+@.+$ and the length of the value is 256 characters or less, then the properties.SenderFromAddress log field is mapped to the network.email.from UDM field.
Else, the additional.fields.key UDM field is set to SenderFromAddress and the properties.SenderFromAddress log field value is mapped to the additional.fields.value.string_value UDM field.
properties.SenderFromAddress principal.user.email_addresses If the properties.SenderFromAddress log field value matches the regular expression pattern ^.+@.+$, then the properties.SenderFromAddress log field is mapped to the principal.user.email_addresses UDM field.
properties.SenderMailFromDomain principal.user.attribute.labels[sender_mail_from_domain]
properties.SenderObjectId principal.user.product_object_id
properties.SenderDisplayName principal.user.user_display_name
properties.ThreatTypes security_result.category If the properties.ThreatTypes log field value is equal to Phish, then the security_result.category UDM field is set to MAIL_PHISHING.

Else, if the properties.ThreatTypes log field value is equal to Malware, then the security_result.category UDM field is set to SOFTWARE_MALICIOUS.

Else, if the properties.ThreatTypes log field value is equal to Spam, then the security_result.category UDM field is set to MAIL_SPAM.

Else, the security_result.category UDM field is set to UNKNOWN_CATEGORY.
properties.ThreatTypes security_result.category_details
properties.ConfidenceLevel security_result.confidence_details
properties.EmailAction security_result.description
properties.AuthenticationDetails security_result.detection_fields[authentication_details]
properties.BulkComplaintLevel security_result.detection_fields[bulk_complaint_level]
properties.DetectionMethods security_result.detection_fields[detection_methods]
properties.EmailActionPolicyGuid security_result.rule_id
properties.EmailActionPolicy security_result.rule_name
properties.ThreatNames security_result.threat_name
properties.OrgLevelAction security_result.rule_labels[org_level_action]
properties.OrgLevelPolicy security_result.rule_labels[org_level_policy]
properties.UserLevelAction security_result.rule_labels[user_level_action]
properties.UserLevelPolicy security_result.rule_labels[user_level_policy]
properties.RecipientEmailAddress network.email.to If the properties.RecipientEmailAddress log field value matches the regular expression pattern ^.+@.+$ and the length of the value is 256 characters or less, then the properties.RecipientEmailAddress log field is mapped to the network.email.to UDM field.

Else, the additional.fields.key UDM field is set to RecipientEmailAddress and the properties.RecipientEmailAddress log field value is mapped to the additional.fields.value.string_value UDM field.
properties.RecipientEmailAddress target.user.email_addresses If the properties.RecipientEmailAddress log field value matches the regular expression pattern ^.+@.+$, then the properties.RecipientEmailAddress log field is mapped to the target.user.email_addresses UDM field.
properties.RecipientObjectId target.user.product_object_id
properties.AdditionalFields additional.fields[additional_fields]
properties.DeliveryAction security_result.action If the properties.DeliveryAction log field is equal to Delivered, then the security_result.action UDM field is set to ALLOW.

Else, if the properties.DeliveryAction log field contains one of the following values:
  • Junked
  • Replaced
then the security_result.action UDM field is set to ALLOW_WITH_MODIFICATION.

Else, if the properties.DeliveryAction log field is equal to Blocked, then the security_result.action UDM field is set to BLOCK.

Else, the security_result.action UDM field is set to UNKNOWN_ACTION.
properties.DeliveryAction security_result.action_details
properties.DeliveryLocation additional.fields[delivery_location] The properties.DeliveryLocation log field is mapped to the additional.fields.delivery_location UDM field.
properties.EmailClusterId additional.fields[email_cluster_id]
properties.EmailLanguage additional.fields[email_language]
properties.InternetMessageId additional.fields[internet_message_id]
properties.LatestDeliveryLocation additional.fields[last_delivery_location]
properties.UrlCount additional.fields[url_count]
properties.Connectors additional.fields[connectors]
properties.AttachmentCount additional.fields[attachment_count]
properties.LatestDeliveryAction additional.fields[latest_delivery_action]

필드 매핑 참조: MICROSOFT DEFENDER ENDPOINT - EmailPostDeliveryEvents

다음 표에는 EmailPostDeliveryEvents 로그 유형의 로그 필드와 해당 UDM 필드가 나와 있습니다.
Log field UDM mapping Logic
properties.Timestamp metadata.event_timestamp
metadata.event_type The metadata.event_type UDM field is set to EMAIL_TRANSACTION.
properties.ReportId security_result.detection_fields[report_id]
properties.NetworkMessageId network.email.mail_id
properties.ActionResult security_result.summary
properties.ThreatTypes security_result.category If the properties.ThreatTypes log field value is equal to Phish, then the security_result.category UDM field is set to MAIL_PHISHING.

Else, if the properties.ThreatTypes log field value is equal to Malware, then the security_result.category UDM field is set to SOFTWARE_MALICIOUS.

Else, if the properties.ThreatTypes log field value is equal to Spam, then the security_result.category UDM field is set to MAIL_SPAM.

Else, the security_result.category UDM field is set to UNKNOWN_CATEGORY.
properties.ThreatTypes security_result.category_details
properties.ActionTrigger security_result.detection_fields[action_trigger]
properties.DeliveryLocation security_result.detection_fields[delivery_location]
properties.DetectionMethods security_result.detection_fields[detection_methods]
properties.Action security_result.action If the properties.Action log field is equal to Moved to quarantine, then the security_result.action UDM field is set to QUARANTINE.

Else, if the properties.Action log field is equal to Added message info only, then the security_result.action UDM field is set to ALLOW_WITH_MODIFICATION.

Else, if the properties.Action log field is equal to Quarantine release, then the security_result.action UDM field is set to ALLOW.

Else, if the properties.Action log field is equal to Moved to junk folder, then the security_result.action UDM field is set to ALLOW_WITH_MODIFICATION.

Else, if the properties.Action log field is equal to Reprocessed, then the security_result.action UDM field is set to CHALLENGE.

Else, the security_result.action UDM field is set to UNKNOWN_ACTION.
properties.Action security_result.action_details
properties.ActionType security_result.verdict_info.verdict_type If the properties.ActionType log field value is equal to Manual Remediation, then the security_result.verdict_info.verdict_type UDM field is set to ANALYST_VERDICT.

Else, if the properties.ActionType log field contains one of the following values, then the security_result.verdict_info.verdict_type UDM field is set to PROVIDER_ML_VERDICT.
  • Phish ZAP
  • Malware ZAP
  • Spam ZAP
.
properties.RecipientEmailAddress target.user.email_addresses If the properties.RecipientEmailAddress log field value matches the regular expression pattern ^.+@.+$, then the properties.RecipientEmailAddress log field is mapped to the target.user.email_addresses UDM field.
properties.InternetMessageId additional.fields[internet_message_id]

필드 매핑 참조: MICROSOFT DEFENDER ENDPOINT - EmailUrlInfo

다음 표에는 EmailUrlInfo 로그 유형의 로그 필드와 해당 UDM 필드가 나와 있습니다.

Log field UDM mapping Logic
properties.UrlDomain target.hostname
properties.Url target.url
properties.Timestamp metadata.event_timestamp
metadata.event_type The metadata.event_type UDM field is set to EMAIL_TRANSACTION.
properties.ReportId metadata.product_log_id
properties.NetworkMessageId network.email.mail_id
properties.UrlLocation additional.fields[url_location]

필드 매핑 참조: MICROSOFT DEFENDER ENDPOINT - IdentityInfo

다음 표에는 IdentityInfo 로그 유형의 로그 필드와 해당 UDM 필드가 나와 있습니다.

Log field UDM mapping Logic
properties.BlastRadius entity.user.attribute.labels[blast_radius]
properties.CompanyName entity.user.company_name
properties.CriticalityLevel entity.user.attribute.labels[criticality_level]
properties.DeletedDateTime entity.user.attribute.labels[deleted_date_time]
properties.EmployeeId entity.user.employee_id
properties.GroupMembership entity.user.group_identifiers
properties.IdentityEnvironment entity.user.attribute.labels[identity_environment]
properties.OnPremObjectId entity.user.attribute.labels[on_prem_object_id]
properties.OtherMailAddresses entity.user.email_addresses
properties.PrivilegedEntraPimRoles entity.user.attribute.roles.name
properties.RiskLevel entity.user.attribute.labels[risk_level]
properties.RiskLevelDetails entity.user.attribute.labels[risk_level_details]
properties.RiskStatus entity.user.attribute.labels[risk_status]
properties.SourceProviders entity.user.attribute.labels[source_providers]
properties.State entity.user.personal_address.state
properties.TenantMembershipType entity.user.attribute.labels[tenant_membership_type]
properties.UserAccountControl entity.user.attribute.labels[user_account_control]
properties.SourceSystem entity.resource.parent
properties.AccountDomain entity.administrative_domain
properties.TenantId entity.resource.product_object_id
properties.CreatedDateTime entity.user.attribute.creation_time
properties.AccountUpn entity.user.attribute.labels[account_upn]
properties.ChangeSource entity.user.attribute.labels[change_source]
properties.CloudSid entity.user.attribute.labels[cloud_sid]
properties.ReportId entity.user.attribute.labels[report_id]
properties.SipProxyAddress entity.user.attribute.labels[sip_proxy_address]
properties.SourceProvider entity.user.attribute.labels[source_provider]
properties.Tags entity.user.attribute.labels[tags]
properties.Type entity.user.account_type If the properties.Type log field is equal to User, then the entity.user.account_type UDM field is set to DOMAIN_ACCOUNT_TYPE.

Else, if the properties.Type log field is equal to ServiceAccount, then the entity.user.account_type UDM field is set to SERVICE_ACCOUNT_TYPE.
properties.Type entity.user.attribute.labels[type]
properties.DistinguishedName entity.user.attributes.labels[distinguished_name]
properties.Department entity.user.department
properties.EmailAddress entity.user.email_addresses If the properties.EmailAddress log field value matches the regular expression pattern ^.+@.+$, then the properties.EmailAddress log field is mapped to the entity.user.email_addresses UDM field.
properties.GivenName entity.user.first_name
properties.Surname entity.user.last_name
properties.Manager entity.user.managers.user_display_name
properties.City entity.user.personal_address.city
properties.Country entity.user.personal_address.country_or_region
properties.Address entity.user.personal_address.name
properties.Phone entity.user.phone_numbers
properties.AccountObjectId entity.user.product_object_id
properties.AssignedRoles entity.user.role_description
properties.JobTitle entity.user.title
properties.IsAccountEnabled entity.user.user_authentication_status If the properties.IsAccountEnabled log field value is equal to 1 or true, then the entity.user.user_authentication_status UDM field is set to ACTIVE.

Else, the entity.user.user_authentication_status UDM field is set to SUSPENDED.
properties.AccountDisplayName entity.user.user_display_name
properties.AccountName entity.user.userid
properties.OnPremSid entity.user.attribute.labels[on_prem_sid]
properties.Timestamp metadata.creation_time
metadata.entity_type The metadata.entity_type UDM field is set to USER.
properties.AccountObjectId metadata.product_entity_id

필드 매핑 참조: MICROSOFT DEFENDER ENDPOINT - CloudAppEvents

다음 표에는 CloudAppEvents 로그 유형의 로그 필드와 해당 UDM 필드가 나와 있습니다.

Log field UDM mapping Logic
properties.Timestamp metadata.event_timestamp
metadata.event_type The metadata.event_type UDM field is set to GENERIC_EVENT.
properties.ActionType security_result.summary
properties.Application additional.fields[application]
properties.ApplicationId additional.fields[application_id]
properties.AppInstanceId additional.fields[app_instance_id]
properties.AccountObjectId principal.user.product_object_id
properties.AccountId principal.user.userid
properties.AccountDisplayName principal.user.user_display_name
properties.IsAdminOperation principal.user.attribute.role.type If the properties.IsAdminOperation is equal to true, then the principal.user.attribute.role.type is set to ADMINISTRATOR.
properties.DeviceType principal.asset.type If the properties.DeviceType log field value is equal to NetworkDevice, then the principal.asset.type UDM field is set to NETWORK_ATTACHED_STORAGE.
Else, if the properties.DeviceType log field value is equal to Workstation, then the principal.asset.type UDM field is set to WORKSTATION.
Else, if the properties.DeviceType log field value is equal to Server, then the principal.asset.type UDM field is set to SERVER.
Else, if the properties.DeviceType log field value is equal to Mobile, then the principal.asset.type UDM field is set to MOBILE.
Else if the properties.DeviceType log field value is equal to Printer, then the principal.asset.type UDM field is set to PRINTER.
Else, the principal.asset.type UDM field is set to ROLE_UNSPECIFIED and properties.DeviceType is mapped to principal.asset.attribute.labels[device_type].
properties.OSPlatform principal.asset.platform_software.platform If the properties.OSPlatform log field value matches the regular expression pattern (?i)macos, then the principal.asset.platform_software.platform UDM field is set to MAC.

Else, if the properties.OSPlatform log field value matches the regular expression pattern (?i)windows, then the principal.asset.platform_software.platform UDM field is set to WINDOWS.

Else, if the properties.OSPlatform log field value matches the regular expression pattern (?i)linux, then the principal.asset.platform_software.platform UDM field is set to LINUX.
properties.OSPlatform principal.asset.platform_software.platform_version
properties.IPAddresses principal.ip
properties.IsAnonymousProxy principal.asset.attribute.labels[is_anonymous_proxy] The properties.IsAnonymousProxy log field is mapped to the principal.asset.attribute.labels[is_anonymous_proxy] UDM field.
properties.CountryCode principal.ip_geo_artifact.location.country_or_region
properties.City principal.ip_geo_artifact.location.city
properties.Isp principal.asset.attribute.labels[isp] The properties.Isp log field is mapped to the principal.asset.attribute.labels[isp] UDM field.
properties.UserAgent network.http.user_agent
properties.ActivityType additional.fields[activity_type]
properties.ActivityObjects additional.fields[activity_objects]
properties.ObjectName target.resource.name
properties.ObjectType target.resource.resource_subtype
properties.ObjectId target.resource.product_object_id
properties.ReportId metadata.product_log_id
properties.AccountType principal.asset.attribute.labels[account_type] The properties.AccountType log field is mapped to the principal.asset.attribute.labels[account_type] UDM field.
properties.IsExternalUser principal.asset.attribute.labels[is_external_user] The properties.IsExternalUser log field is mapped to the principal.asset.attribute.labels[is_external_user] UDM field.
properties.IsImpersonated principal.asset.attribute.labels[is_impersonated] The properties.IsImpersonatedr log field is mapped to the principal.asset.attribute.labels[is_impersonated] UDM field.
properties.IPTags principal.asset.attribute.labels[ip_tags] The properties.IPTags log field is mapped to the principal.asset.attribute.labels[ip_tags] UDM field.
properties.IPCategory principal.asset.attribute.labels[ip_category] The properties.IPCategory log field is mapped to the principal.asset.attribute.labels[ip_category] UDM field.
properties.UserAgentTags principal.asset.attribute.labels[user_agent_tags] The properties.UserAgentTags log field is mapped to the principal.asset.attribute.labels[user_agent_tags] UDM field.
properties.RawEventData additional.fields[raw_event_data] Iterate for each key, value pair of log field properties.RawEventData, then
value log field is mapped to the additional.fields.key UDM field.
Iterate for each key1, value1 pair of log field value, then
value1 log field is mapped to the additional.fields.key UDM field.
Iterate for each key2, value2 pair of log field value1, then
value2 log field is mapped to the additional.fields.key UDM field.
Iterate for each key3, value3 pair of log field value2, then
value3 log field is mapped to the additional.fields.key UDM field.
properties.AdditionalFields additional.fields[additional_fields] Iterate for each key, value pair of log field properties.AdditionalFields, then
value log field is mapped to the additional.fields.key UDM field.
properties.LastSeenForUser additional.fields[last_seen_for_user] Iterate for each key, value pair of log field properties.LastSeenForUser, then
value log field is mapped to the additional.fields.key UDM field.
properties.UncommonForUser additional.fields[uncommon_for_user] Iterate for each key, value pair of log field properties.UncommonForUser, then
value log field is mapped to the additional.fields.key UDM field.
properties.AuditSource additional.fields[audit_source]
properties.SessionData additional.fields[session_data]
properties.OAuthAppId additional.fields[oauth_app_id]

UDM 매핑 델타

UDM 매핑 델타 참조: MICROSOFT DEFENDER ENDPOINT

다음 표에는 Microsoft Defender Endpoint의 이전 UDM 매핑과 Microsoft Defender Endpoint의 새 UDM 매핑 간의 차이가 나와 있습니다.

UDM 매핑 델타 참조: DeviceEvents 이벤트 식별자에서 이벤트 유형으로

다음 표에는 DeviceEvents 로그 작업 유형의 델타와 해당 UDM 이벤트 유형이 나와 있습니다.

Event Identifier Old UDM Event Type Mapping New UDM Event Type Mapping
AntivirusDefinitionsUpdateFailed SCAN_HOST SETTING_MODIFICATION
AntivirusEmergencyUpdatesInstalled SCAN_HOST SETTING_MODIFICATION
AntivirusTroubleshootModeEvent SCAN_HOST STATUS_UPDATE
AppControlCodeIntegrityDriverRevoked SCAN_HOST SCAN_FILE
AppControlCodeIntegrityImageAudited SCAN_HOST SCAN_FILE
AppControlCodeIntegrityImageRevoked SCAN_HOST SCAN_FILE
AppControlCodeIntegrityOriginAllowed SCAN_HOST SCAN_FILE
AppControlCodeIntegrityOriginAudited SCAN_HOST SCAN_FILE
AppControlCodeIntegrityOriginBlocked SCAN_HOST SCAN_FILE
AppControlCodeIntegrityPolicyAudited SCAN_HOST SCAN_FILE
AppControlCodeIntegrityPolicyBlocked SCAN_HOST SCAN_FILE
AppControlCodeIntegrityPolicyLoaded SCAN_HOST SCAN_FILE
AppControlCodeIntegritySigningInformation SCAN_HOST GENERIC_EVENT
AppControlPolicyApplied SCAN_HOST SETTING_MODIFICATION
AppGuardBrowseToUrl SCAN_HOST NETWORK_UNCATEGORIZED
AppGuardCreateContainer SCAN_HOST PROCESS_LAUNCH
AppGuardLaunchedWithUrl SCAN_HOST PROCESS_LAUNCH
AppGuardResumeContainer SCAN_HOST PROCESS_UNCATEGORIZED
AppGuardStopContainer SCAN_HOST PROCESS_TERMINATION
AppGuardSuspendContainer SCAN_HOST PROCESS_UNCATEGORIZED
AppLockerBlockExecutable PROCESS_UNCATEGORIZED SCAN_HOST
AppLockerBlockPackagedApp STATUS_UPDATE SCAN_HOST
AppLockerBlockPackagedAppInstallation STATUS_UPDATE SCAN_HOST
AppLockerBlockScript STATUS_UPDATE SCAN_HOST
AuditPolicyModification SERVICE_MODIFICATION SETTING_MODIFICATION
BitLockerAuditCompleted SERVICE_UNSPECIFIED STATUS_UPDATE
BluetoothPolicyTriggered STATUS_UPDATE SCAN_HOST
ContainedDeviceConnectionBlocked NETWORK_UNCATEGORIZED NETWORK_CONNECTION
ControlFlowGuardViolation STATUS_UPDATE SCAN_HOST
DeviceBootAttestationInfo STATUS_UPDATE GENERIC_EVENT
DirectoryServiceObjectCreated SERVICE_MODIFICATION RESOURCE_CREATION
DirectoryServiceObjectModified SERVICE_MODIFICATION RESOURCE_WRITTEN
DpapiAccessed GENERIC_EVENT PROCESS_UNCATEGORIZED
GetAsyncKeyStateApiCall STATUS_UPDATE PROCESS_UNCATEGORIZED
GetClipboardData STATUS_UPDATE PROCESS_UNCATEGORIZED
LdapSearch STATUS_UPDATE RESOURCE_READ
NetworkShareObjectAccessChecked NETWORK_UNCATEGORIZED RESOURCE_READ
NetworkShareObjectAdded NETWORK_UNCATEGORIZED RESOURCE_CREATION
NetworkShareObjectDeleted NETWORK_UNCATEGORIZED RESOURCE_DELETION
NetworkShareObjectModified NETWORK_UNCATEGORIZED RESOURCE_WRITTEN
PnpDeviceAllowed DEVICE_CONFIG_UPDATE SCAN_HOST
PnpDeviceBlocked STATUS_UPDATE SCAN_HOST
PnpDeviceConnected STATUS_UPDATE DEVICE_CONFIG_UPDATE
PrintJobBlocked STATUS_UPDATE SCAN_UNCATEGORIZED
QueueUserApcRemoteApiCall PROCESS_LAUNCH PROCESS_UNCATEGORIZED
RemoteWmiOperation NETWORK_CONNECTION PROCESS_UNCATEGORIZED
RemovableStoragePolicyTriggered STATUS_UPDATE PROCESS_UNCATEGORIZED
SmartScreenAppWarning SCAN_UNCATEGORIZED SCAN_HOST
SmartScreenExploitWarning SCAN_UNCATEGORIZED SCAN_HOST
SmartScreenUrlWarning SCAN_UNCATEGORIZED SCAN_HOST
SmartScreenUserOverride SCAN_UNCATEGORIZED SETTING_MODIFICATION
WmiBindEventFilterToConsumer STATUS_UPDATE PROCESS_UNCATEGORIZED

UDM 매핑 델타 참조: MICROSOFT DEFENDER ENDPOINT - DeviceEvents

다음 표에는 DeviceEvents 로그 유형의 로그 필드 델타와 해당 UDM 필드가 나와 있습니다.

Raw Field Old UDM Mapping New UDM Mapping
properties.DeviceId principal.asset_id
principal.asset.asset_id		 If the properties.ActionType log field contains one of the following values, then DeviceID:%{properties.DeviceId} is mapped to the target.asset_id and target.asset.asset_id UDM field:
  • RemoteWmiOperation
  • ProcessCreatedUsingWmiQuery
Else, DeviceID:%{properties.DeviceId} is mapped to the principal.asset_id and principal.asset.asset_id UDM fields.
properties.DeviceName principal.hostname
principal.asset.hostname		 If the properties.ActionType log field contains one of the following values, then the properties.DeviceName log field is mapped to the target.hostname and target.asset.hostname UDM field:
  • RemoteWmiOperation
  • ProcessCreatedUsingWmiQuery
Else, the properties.DeviceName log field is mapped to the principal.hostname and principal.asset.hostname UDM fields.
properties.LocalIP principal.ip
principal.asset.ip		 If the properties.ActionType log field contains one of the following values, then the properties.LocalIP log field is mapped to the target.ip and target.asset.ip UDM field:
  • RemoteWmiOperation
  • ProcessCreatedUsingWmiQuery
Else, the properties.LocalIP log field is mapped to the principal.ip and principal.asset.ip UDM fields.
properties.LocalPort principal.port If the properties.ActionType log field contains one of the following values, then the properties.LocalPort log field is mapped to the target.port UDM field:
  • RemoteWmiOperation
  • ProcessCreatedUsingWmiQuery
Else, the properties.LocalPort log field is mapped to the principal.port UDM field.
properties.FolderPath target.file.full_path
target.process.file.full_path		 If the properties.ActionType log field contains one of the following values:
  • AmsiScriptDetection
  • AppGuardCreateContainer
  • AppGuardLaunchedWithUrl
  • AppGuardResumeContainer
  • AppGuardStopContainer
  • AppGuardSuspendContainer
  • ClrUnbackedModuleLoaded
  • CreateRemoteThreadApiCall
  • DpapiAccessed
  • DriverLoad
  • GetAsyncKeyStateApiCall
  • GetClipboardData
  • MemoryRemoteProtect
  • NamedPipeEvent
  • NtAllocateVirtualMemoryApiCall
  • NtAllocateVirtualMemoryRemoteApiCall
  • NtMapViewOfSectionRemoteApiCall
  • NtProtectVirtualMemoryApiCall
  • OpenProcessApiCall
  • PowerShellCommand
  • ProcessCreatedUsingWmiQuery
  • ProcessPrimaryTokenModified
  • PTraceDetected
  • QueueUserApcRemoteApiCall
  • ReadProcessMemoryApiCall
  • RemoteWmiOperation
  • RemovableStoragePolicyTriggered
  • ScriptContent
  • SetThreadContextRemoteApiCall
  • WmiBindEventFilterToConsumer
  • WriteProcessMemoryApiCall
  • WriteToLsassProcessMemory
  • AsrAdobeReaderChildProcessAudited
  • AsrAdobeReaderChildProcessBlocked
  • AsrAdobeReaderChildProcessWarnBypassed
  • AsrOfficeChildProcessAudited
  • AsrOfficeChildProcessBlocked
  • AsrOfficeChildProcessWarnBypassed
  • AsrOfficeCommAppChildProcessAudited
  • AsrOfficeCommAppChildProcessBlocked
  • AsrOfficeCommAppChildProcessWarnBypassed
  • AsrOfficeProcessInjectionAudited
  • AsrOfficeProcessInjectionBlocked
  • AsrOfficeProcessInjectionWarnBypassed
  • AsrPsexecWmiChildProcessAudited
  • AsrPsexecWmiChildProcessBlocked
  • AsrPsexecWmiChildProcessWarnBypassed
  • AsrUntrustedUsbProcessAudited
  • AsrUntrustedUsbProcessBlocked
  • AsrUntrustedUsbProcessWarnBypassed
  • ExploitGuardChildProcessAudited
  • ExploitGuardChildProcessBlocked
then if the properties.FolderPath log field value matches the regular expression pattern the properties.FileName log field value , then properties.FolderPath log field is mapped to the target.process.file.full_path UDM field, else %{properties.FolderPath}\%{properties.FileName} is mapped to the target.process.file.full_path UDM field.
Else, if the properties.FolderPath log field value matches the regular expression pattern the properties.FileName log field value , then properties.FolderPath log field is mapped to the target.file.full_path UDM field, else %{properties.FolderPath}\%{properties.FileName} is mapped to the target.file.full_path UDM field.
properties.MD5 target.file.md5
target.process.file.md5		 If the properties.ActionType log field contains one of the following values:
  • AmsiScriptDetection
  • AppGuardCreateContainer
  • AppGuardLaunchedWithUrl
  • AppGuardResumeContainer
  • AppGuardStopContainer
  • AppGuardSuspendContainer
  • ClrUnbackedModuleLoaded
  • CreateRemoteThreadApiCall
  • DpapiAccessed
  • DriverLoad
  • GetAsyncKeyStateApiCall
  • GetClipboardData
  • MemoryRemoteProtect
  • NamedPipeEvent
  • NtAllocateVirtualMemoryApiCall
  • NtAllocateVirtualMemoryRemoteApiCall
  • NtMapViewOfSectionRemoteApiCall
  • NtProtectVirtualMemoryApiCall
  • OpenProcessApiCall
  • PowerShellCommand
  • ProcessCreatedUsingWmiQuery
  • ProcessPrimaryTokenModified
  • PTraceDetected
  • QueueUserApcRemoteApiCall
  • ReadProcessMemoryApiCall
  • RemoteWmiOperation
  • RemovableStoragePolicyTriggered
  • ScriptContent
  • SetThreadContextRemoteApiCall
  • WmiBindEventFilterToConsumer
  • WriteProcessMemoryApiCall
  • WriteToLsassProcessMemory
  • AsrAdobeReaderChildProcessAudited
  • AsrAdobeReaderChildProcessBlocked
  • AsrAdobeReaderChildProcessWarnBypassed
  • AsrOfficeChildProcessAudited
  • AsrOfficeChildProcessBlocked
  • AsrOfficeChildProcessWarnBypassed
  • AsrOfficeCommAppChildProcessAudited
  • AsrOfficeCommAppChildProcessBlocked
  • AsrOfficeCommAppChildProcessWarnBypassed
  • AsrOfficeProcessInjectionAudited
  • AsrOfficeProcessInjectionBlocked
  • AsrOfficeProcessInjectionWarnBypassed
  • AsrPsexecWmiChildProcessAudited
  • AsrPsexecWmiChildProcessBlocked
  • AsrPsexecWmiChildProcessWarnBypassed
  • AsrUntrustedUsbProcessAudited
  • AsrUntrustedUsbProcessBlocked
  • AsrUntrustedUsbProcessWarnBypassed
  • ExploitGuardChildProcessAudited
  • ExploitGuardChildProcessBlocked
and if the properties.MD5 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.MD5 log field is mapped to the target.process.file.md5 UDM field.
Else, if the properties.MD5 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.MD5 log field is mapped to the target.file.md5 UDM field.
properties.FileName target.file.names
target.process.file.names		 If the properties.ActionType log field contains one of the following values:
  • AmsiScriptDetection
  • AppGuardCreateContainer
  • AppGuardLaunchedWithUrl
  • AppGuardResumeContainer
  • AppGuardStopContainer
  • AppGuardSuspendContainer
  • ClrUnbackedModuleLoaded
  • CreateRemoteThreadApiCall
  • DpapiAccessed
  • DriverLoad
  • GetAsyncKeyStateApiCall
  • GetClipboardData
  • MemoryRemoteProtect
  • NamedPipeEvent
  • NtAllocateVirtualMemoryApiCall
  • NtAllocateVirtualMemoryRemoteApiCall
  • NtMapViewOfSectionRemoteApiCall
  • NtProtectVirtualMemoryApiCall
  • OpenProcessApiCall
  • PowerShellCommand
  • ProcessCreatedUsingWmiQuery
  • ProcessPrimaryTokenModified
  • PTraceDetected
  • QueueUserApcRemoteApiCall
  • ReadProcessMemoryApiCall
  • RemoteWmiOperation
  • RemovableStoragePolicyTriggered
  • ScriptContent
  • SetThreadContextRemoteApiCall
  • WmiBindEventFilterToConsumer
  • WriteProcessMemoryApiCall
  • WriteToLsassProcessMemory
  • AsrAdobeReaderChildProcessAudited
  • AsrAdobeReaderChildProcessBlocked
  • AsrAdobeReaderChildProcessWarnBypassed
  • AsrOfficeChildProcessAudited
  • AsrOfficeChildProcessBlocked
  • AsrOfficeChildProcessWarnBypassed
  • AsrOfficeCommAppChildProcessAudited
  • AsrOfficeCommAppChildProcessBlocked
  • AsrOfficeCommAppChildProcessWarnBypassed
  • AsrOfficeProcessInjectionAudited
  • AsrOfficeProcessInjectionBlocked
  • AsrOfficeProcessInjectionWarnBypassed
  • AsrPsexecWmiChildProcessAudited
  • AsrPsexecWmiChildProcessBlocked
  • AsrPsexecWmiChildProcessWarnBypassed
  • AsrUntrustedUsbProcessAudited
  • AsrUntrustedUsbProcessBlocked
  • AsrUntrustedUsbProcessWarnBypassed
  • ExploitGuardChildProcessAudited
  • ExploitGuardChildProcessBlocked
then properties.FileName log field is mapped to the target.process.file.names UDM field.
Else, properties.FileName log field is mapped to the target.file.names UDM field.
properties.SHA1 target.file.sha1
target.process.file.sha1		 If the properties.ActionType log field contains one of the following values:
  • AmsiScriptDetection
  • AppGuardCreateContainer
  • AppGuardLaunchedWithUrl
  • AppGuardResumeContainer
  • AppGuardStopContainer
  • AppGuardSuspendContainer
  • ClrUnbackedModuleLoaded
  • CreateRemoteThreadApiCall
  • DpapiAccessed
  • DriverLoad
  • GetAsyncKeyStateApiCall
  • GetClipboardData
  • MemoryRemoteProtect
  • NamedPipeEvent
  • NtAllocateVirtualMemoryApiCall
  • NtAllocateVirtualMemoryRemoteApiCall
  • NtMapViewOfSectionRemoteApiCall
  • NtProtectVirtualMemoryApiCall
  • OpenProcessApiCall
  • PowerShellCommand
  • ProcessCreatedUsingWmiQuery
  • ProcessPrimaryTokenModified
  • PTraceDetected
  • QueueUserApcRemoteApiCall
  • ReadProcessMemoryApiCall
  • RemoteWmiOperation
  • RemovableStoragePolicyTriggered
  • ScriptContent
  • SetThreadContextRemoteApiCall
  • WmiBindEventFilterToConsumer
  • WriteProcessMemoryApiCall
  • WriteToLsassProcessMemory
  • AsrAdobeReaderChildProcessAudited
  • AsrAdobeReaderChildProcessBlocked
  • AsrAdobeReaderChildProcessWarnBypassed
  • AsrOfficeChildProcessAudited
  • AsrOfficeChildProcessBlocked
  • AsrOfficeChildProcessWarnBypassed
  • AsrOfficeCommAppChildProcessAudited
  • AsrOfficeCommAppChildProcessBlocked
  • AsrOfficeCommAppChildProcessWarnBypassed
  • AsrOfficeProcessInjectionAudited
  • AsrOfficeProcessInjectionBlocked
  • AsrOfficeProcessInjectionWarnBypassed
  • AsrPsexecWmiChildProcessAudited
  • AsrPsexecWmiChildProcessBlocked
  • AsrPsexecWmiChildProcessWarnBypassed
  • AsrUntrustedUsbProcessAudited
  • AsrUntrustedUsbProcessBlocked
  • AsrUntrustedUsbProcessWarnBypassed
  • ExploitGuardChildProcessAudited
  • ExploitGuardChildProcessBlocked
and if the properties.SHA1 log field value matches the regular expression pattern ^[0-9a-f]+$, then properties.SHA1 log field is mapped to the target.process.file.sha1 UDM field.
Else, if the properties.SHA1 log field value matches the regular expression pattern ^[0-9a-f]+$, then properties.SHA1 log field is mapped to the target.file.sha1 UDM field.
properties.SHA256 target.file.sha256
target.process.file.sha256		 If the properties.ActionType log field contains one of the following values:
  • AmsiScriptDetection
  • AppGuardCreateContainer
  • AppGuardLaunchedWithUrl
  • AppGuardResumeContainer
  • AppGuardStopContainer
  • AppGuardSuspendContainer
  • ClrUnbackedModuleLoaded
  • CreateRemoteThreadApiCall
  • DpapiAccessed
  • DriverLoad
  • GetAsyncKeyStateApiCall
  • GetClipboardData
  • MemoryRemoteProtect
  • NamedPipeEvent
  • NtAllocateVirtualMemoryApiCall
  • NtAllocateVirtualMemoryRemoteApiCall
  • NtMapViewOfSectionRemoteApiCall
  • NtProtectVirtualMemoryApiCall
  • OpenProcessApiCall
  • PowerShellCommand
  • ProcessCreatedUsingWmiQuery
  • ProcessPrimaryTokenModified
  • PTraceDetected
  • QueueUserApcRemoteApiCall
  • ReadProcessMemoryApiCall
  • RemoteWmiOperation
  • RemovableStoragePolicyTriggered
  • ScriptContent
  • SetThreadContextRemoteApiCall
  • WmiBindEventFilterToConsumer
  • WriteProcessMemoryApiCall
  • WriteToLsassProcessMemory
  • AsrAdobeReaderChildProcessAudited
  • AsrAdobeReaderChildProcessBlocked
  • AsrAdobeReaderChildProcessWarnBypassed
  • AsrOfficeChildProcessAudited
  • AsrOfficeChildProcessBlocked
  • AsrOfficeChildProcessWarnBypassed
  • AsrOfficeCommAppChildProcessAudited
  • AsrOfficeCommAppChildProcessBlocked
  • AsrOfficeCommAppChildProcessWarnBypassed
  • AsrOfficeProcessInjectionAudited
  • AsrOfficeProcessInjectionBlocked
  • AsrOfficeProcessInjectionWarnBypassed
  • AsrPsexecWmiChildProcessAudited
  • AsrPsexecWmiChildProcessBlocked
  • AsrPsexecWmiChildProcessWarnBypassed
  • AsrUntrustedUsbProcessAudited
  • AsrUntrustedUsbProcessBlocked
  • AsrUntrustedUsbProcessWarnBypassed
  • ExploitGuardChildProcessAudited
  • ExploitGuardChildProcessBlocked
and if the properties.SHA256 log field value matches the regular expression pattern ^[a-f0-9]{64}$, then properties.SHA256 log field is mapped to the target.process.file.sha256 UDM field.
Else, if the properties.SHA256 log field value matches the regular expression pattern ^[a-f0-9]{64}$, then properties.SHA256 log field is mapped to the target.file.sha256 UDM field.
properties.FileSize target.file.size
target.process.file.size		 If the properties.ActionType log field contains one of the following values:
  • AmsiScriptDetection
  • AppGuardCreateContainer
  • AppGuardLaunchedWithUrl
  • AppGuardResumeContainer
  • AppGuardStopContainer
  • AppGuardSuspendContainer
  • ClrUnbackedModuleLoaded
  • CreateRemoteThreadApiCall
  • DpapiAccessed
  • DriverLoad
  • GetAsyncKeyStateApiCall
  • GetClipboardData
  • MemoryRemoteProtect
  • NamedPipeEvent
  • NtAllocateVirtualMemoryApiCall
  • NtAllocateVirtualMemoryRemoteApiCall
  • NtMapViewOfSectionRemoteApiCall
  • NtProtectVirtualMemoryApiCall
  • OpenProcessApiCall
  • PowerShellCommand
  • ProcessCreatedUsingWmiQuery
  • ProcessPrimaryTokenModified
  • PTraceDetected
  • QueueUserApcRemoteApiCall
  • ReadProcessMemoryApiCall
  • RemoteWmiOperation
  • RemovableStoragePolicyTriggered
  • ScriptContent
  • SetThreadContextRemoteApiCall
  • WmiBindEventFilterToConsumer
  • WriteProcessMemoryApiCall
  • WriteToLsassProcessMemory
  • AsrAdobeReaderChildProcessAudited
  • AsrAdobeReaderChildProcessBlocked
  • AsrAdobeReaderChildProcessWarnBypassed
  • AsrOfficeChildProcessAudited
  • AsrOfficeChildProcessBlocked
  • AsrOfficeChildProcessWarnBypassed
  • AsrOfficeCommAppChildProcessAudited
  • AsrOfficeCommAppChildProcessBlocked
  • AsrOfficeCommAppChildProcessWarnBypassed
  • AsrOfficeProcessInjectionAudited
  • AsrOfficeProcessInjectionBlocked
  • AsrOfficeProcessInjectionWarnBypassed
  • AsrPsexecWmiChildProcessAudited
  • AsrPsexecWmiChildProcessBlocked
  • AsrPsexecWmiChildProcessWarnBypassed
  • AsrUntrustedUsbProcessAudited
  • AsrUntrustedUsbProcessBlocked
  • AsrUntrustedUsbProcessWarnBypassed
  • ExploitGuardChildProcessAudited
  • ExploitGuardChildProcessBlocked
then properties.FileSize log field is mapped to the target.process.file.size UDM field.
Else, properties.FileSize log field is mapped to the target.file.size UDM field.
properties.RemoteDeviceName principal.hostname
principal.asset.hostname		 If the properties.ActionType log field contains one of the following values, then the properties.RemoteDeviceName log field is mapped to the principal.hostname and principal.asset.hostname UDM field:
  • RemoteWmiOperation
  • ProcessCreatedUsingWmiQuery
Else, the properties.RemoteDeviceName log field is mapped to the target.hostname and target.asset.hostname UDM fields.
properties.RemoteIP principal.ip
principal.asset.ip		 If the properties.ActionType log field contains one of the following values, then the properties.RemoteIP log field is mapped to the principal.ip and principal.asset.ip UDM field:
  • RemoteWmiOperation
  • ProcessCreatedUsingWmiQuery
Else, the properties.RemoteIP log field is mapped to the target.ip and target.asset.ip UDM fields.
properties.RemotePort principal.port If the properties.ActionType log field contains one of the following values, then the properties.RemotePort log field is mapped to the principal.port UDM field:
  • RemoteWmiOperation
  • ProcessCreatedUsingWmiQuery
Else, the properties.RemotePort log field is mapped to the target.port UDM field.
properties.RemoteUrl principal.url If the properties.ActionType log field contains one of the following values, then the properties.RemoteUrl log field is mapped to the principal.url UDM field:
  • RemoteWmiOperation
  • ProcessCreatedUsingWmiQuery
Else, the properties.RemoteUrl log field is mapped to the target.url UDM field.

UDM 매핑 델타 참조: MICROSOFT DEFENDER ENDPOINT - AlertEvidence

다음 표에는 AlertEvidence 로그 유형의 로그 필드 델타와 해당 UDM 필드가 나와 있습니다.

Raw Field Old UDM Mapping New UDM Mapping
properties.Application additional.fields[application] principal.application
properties.EvidenceDirection principal.user.attribute.labels[evidence_direction] additional.fields[evidence_direction]
properties.EvidenceRole principal.user.attribute.labels[evidence_role] additional.fields[evidence_role]

UDM 매핑 델타 참조: MICROSOFT DEFENDER ENDPOINT - AlertInfo

다음 표에는 AlertInfo 로그 유형의 로그 필드 델타와 해당 UDM 필드가 나와 있습니다.

Raw Field Old UDM Mapping New UDM Mapping
properties.ServiceSource security_result.detection_fields[service_source] principal.application

UDM 매핑 델타 참조: MICROSOFT DEFENDER ENDPOINT - DeviceFileCertificateInfo

다음 표에는 DeviceFileCertificateInfo 로그 유형의 로그 필드 델타와 해당 UDM 필드가 나와 있습니다.

Raw Field Old UDM Mapping New UDM Mapping
properties.Timestamp metadata.event_timestamp metadata.creation_timestamp
The metadata.event_type UDM field is set to STATUS_UPDATE. The metadata.entity_type UDM field is set to FILE.
properties.ReportId metadata.product_log_id metadata.product_entity_id
properties.DeviceId principal.asset_id The entity.asset_id is set to DeviceID:%{properties.DeviceId}.
properties.SHA1 principal.file.sha1 If the properties.SHA1 log field value matches the regular expression pattern ^[0-9a-f]+$, then the properties.SHA1 log field is mapped to the entity.file.sha1 UDM field.
properties.Issuer principal.file.signature_info.sigcheck.signers.cert_issuer entity.file.signature_info.sigcheck.signers.cert_issuer
properties.Signer principal.file.signature_info.sigcheck.signers.name entity.file.signature_info.sigcheck.signers.name
properties.IsSigned principal.file.signature_info.sigcheck.verified If the properties.IsSigned log field value is equal to true, then the entity.file.signature_info.sigcheck.verified UDM field is set to TRUE.
Else, the entity.file.signature_info.sigcheck.verified UDM field is set to FALSE.
properties.DeviceName principal.hostname entity.asset.hostname
properties.CertificateSerialNumber additional.fields[certificate_serial_number] entity.file.signature_info.sigcheck.x509.serial_number

UDM 매핑 델타 참조: MICROSOFT DEFENDER ENDPOINT - DeviceFileEvents

다음 표에는 DeviceFileEvents 로그 유형의 로그 필드 델타와 해당 UDM 필드가 나와 있습니다.

Raw Field Old UDM Mapping New UDM Mapping
properties.FileOriginIP principal.ip src.ip
properties.RequestSourceIP principal.ip src.ip
properties.RequestSourcePort principal.port src.port
properties.FileOriginUrl principal.url src.url

UDM 매핑 델타 참조: MICROSOFT DEFENDER ENDPOINT - DeviceLogonEvents

다음 표에는 DeviceLogonEvents 로그 유형의 로그 필드 델타와 해당 UDM 필드가 나와 있습니다.

Raw Field Old UDM Mapping New UDM Mapping
properties.LogonId network.session_id extensions.auth.auth_details

UDM 매핑 델타 참조: MICROSOFT DEFENDER ENDPOINT - DeviceTvmInfoGathering

다음 표에는 DeviceTvmInfoGathering 로그 유형의 로그 필드 델타와 해당 UDM 필드가 나와 있습니다.

Raw Field Old UDM Mapping New UDM Mapping
properties.LastSeenTime security.result.last_discovered_time principal.asset.last_discover_time

UDM 매핑 델타 참조: MICROSOFT DEFENDER ENDPOINT - DeviceRegistryEvents

다음 표에는 DeviceRegistryEvents 로그 유형의 로그 필드 델타와 해당 UDM 필드가 나와 있습니다.

Raw Field Old UDM Mapping New UDM Mapping
properties.PreviousRegistryValueData principal.registry.registry_value_data src.registry.registry_value_data
properties.PreviousRegistryKey principal.registry.registry_key src.registry.registry_key
properties.PreviousRegistryValueName principal.registry.registry_value_name src.registry.registry_value_name

UDM 매핑 델타 참조: MICROSOFT DEFENDER ENDPOINT - DeviceTvmSoftwareVulnerabilitiesKB

다음 표에는 DeviceTvmSoftwareVulnerabilitiesKB 로그 유형의 로그 필드 델타와 해당 UDM 필드가 나와 있습니다.

Raw Field Old UDM Mapping New UDM Mapping
properties.IsExploitAvailable extensions.vulns.vulnerablities.cvss_vector additional.fields[is_exploit_available]
properties.LastModifiedTime extensions.vulns.vulnerabilities.scan_end_time additional.fields[last_modified_time]
properties.PublishedDate extensions.vulns.vulnerabilities.first_found additional.fields[published_date]
properties.AffectedSoftware extensions.vulns.vulnerabilities.description target.application

UDM 매핑 델타 참조: MICROSOFT DEFENDER ENDPOINT - EmailEvents

다음 표에는 EmailEvents 로그 유형의 로그 필드 델타와 해당 UDM 필드가 나와 있습니다.

Raw Field Old UDM Mapping New UDM Mapping
properties.SenderMailFromAddress principal.user.attribute.labels[sender_mail_from_address] network.email.reply_to
properties.DeliveryAction additional.fields[delivery_action] If the properties.DeliveryAction log field is equal to Delivered, then the security_result.action UDM field is set to ALLOW.
Else, if the properties.DeliveryAction log field contains one of the following values:
  • Junked
  • Replaced
then the security_result.action UDM field is set to ALLOW_WITH_MODIFICATION.
Else, if the properties.DeliveryAction log field is equal to Blocked, then the security_result.action UDM field is set to BLOCK.
Else, the security_result.action UDM field is set to UNKNOWN_ACTION.

UDM 매핑 델타 참조: MICROSOFT DEFENDER ENDPOINT - EmailPostDeliveryEvents

다음 표에는 EmailPostDeliveryEvents 로그 유형의 로그 필드 델타와 해당 UDM 필드가 나와 있습니다.

Raw Field Old UDM Mapping New UDM Mapping
The metadata.event_type UDM field is set to EMAIL_UNCATEGORIZED. The metadata.event_type UDM field is set to EMAIL_TRANSACTION.

UDM 매핑 델타 참조: MICROSOFT DEFENDER ENDPOINT - IdentityInfo

다음 표에는 IdentityInfo 로그 유형의 로그 필드 델타와 해당 UDM 필드가 나와 있습니다.

Raw Field Old UDM Mapping New UDM Mapping
properties.Type entity.user.attribute.role.name If the properties.Type log field is equal to User, then the entity.user.account_type UDM field is set to DOMAIN_ACCOUNT_TYPE.
Else, if the properties.Type log field is equal to ServiceAccount, then the entity.user.account_type UDM field is set to SERVICE_ACCOUNT_TYPE.
properties.Type entity.user.attribute.role.name entity.user.attribute.labels[type]

UDM 매핑 델타 참조: MICROSOFT DEFENDER ENDPOINT - IdentityLogonEvents

다음 표에는 IdentityLogonEvents 로그 유형의 로그 필드 델타와 해당 UDM 필드가 나와 있습니다.

Raw Field Old UDM Mapping New UDM Mapping
properties.Application additional.fields[application] principal.application
properties.AccountObjectId additional.fields[account_object_id] principal.user.product_object_id
properties.DestinationDeviceName src.hostname intermediary.hostname
properties.DestinationPort src.port intermediary.port
properties.DestinationIPAddress src.ip intermediary.ip
properties.AccountUpn principal.user.user_display_name principal.user.email_addresses

다음 단계

변경 로그

이 파서의 변경 로그 보기

도움이 더 필요하신가요? 커뮤니티 회원 및 Google SecOps 전문가에게 문의하여 답변을 받으세요.