| _BilledSize |
|
Double |
| _IsBillable |
|
String |
| _ResourceId |
A unique identifier for the resource that the record is associated with |
String |
| _SubscriptionId |
A unique identifier for the subscription that the record is associated with |
String |
| AdditionalFields |
Additional information, represented using key/value pairs provided by the source which do not map to ASim. |
Object |
| AlertDescription |
Alias or friendly name for EventMessage field. |
String |
| AlertId |
Alias or friendly name for EventUid field. |
String |
| AlertName |
Title or name of the alert. |
String |
| AlertOriginalStatus |
The status of the alert as reported by the originating system. |
String |
| AlertStatus |
Indicates the current state or progress of the alert. |
String |
| AlertVerdict |
The final determination or outcome of the alert, indicating whether the alert was confirmed as a threat, deemed suspicious, or resolved as a false positive. |
String |
| AttackRemediationSteps |
Recommended actions or steps to mitigate or remediate the identified attack or threat. |
String |
| AttackTactics |
The attack tactics (name, ID, or both) associated with the alert. |
String |
| AttackTechniques |
The attack techniques (name, ID, or both) associated with the alert. |
String |
| DetectionMethod |
Provides detailed information about the specific detection method, technology, or data source that contributed to the generation of the alert. |
String |
| DvcAction |
For reporting security systems, the action taken by the system. |
String |
| DvcDescription |
A descriptive text associated with the device. |
String |
| DvcDomain |
The domain of the device reporting the event. |
String |
| DvcDomainType |
The type of DvcDomain. |
String |
| DvcFQDN |
The hostname of the device on which the event occurred or which reported the event. |
String |
| DvcHostname |
The hostname of the device reporting the event. |
String |
| DvcId |
The unique ID of the device on which the event occurred or which reported the event. |
String |
| DvcIdType |
The type of DvcId. |
String |
| DvcInterface |
The network interface on which data was captured. |
String |
| DvcIpAddr |
The IP Address of the device reporting the event. |
String |
| DvcMacAddr |
The MAC address of the device on which the event occurred or which reported the event. |
String |
| DvcOriginalAction |
The original DvcAction as provided by the reporting device. |
String |
| DvcOs |
The operating system running on the device on which the event occurred or which reported the event. |
String |
| DvcOsVersion |
The version of the operating system on the device on which the event occurred or which reported the event. |
String |
| DvcScope |
The cloud platform scope the device belongs to. DvcScope map to a subscription ID on Azure and to an account ID on AWS. |
String |
| DvcScopeId |
The cloud platform scope ID the device belongs to. DvcScopeId map to a subscription ID on Azure and to an account ID on AWS. |
String |
| DvcZone |
The network on which the event occurred or which reported the event. |
String |
| EmailMessageId |
Unique identifier for the email message, associated with the alert. |
String |
| EmailSubject |
Subject of the email. |
String |
| EventCount |
The number of events described by the record. |
Int32 |
| EventEndTime |
The time (UTC) in which the event ended. If the source supports aggregation and the record represents multiple events, the time that the last event was generated. If not provided by the source record, this field aliases the TimeGenerated field. |
DateTime |
| EventMessage |
A general message or description. |
String |
| EventOriginalResultDetails |
The original result details provided by the source. |
String |
| EventOriginalSeverity |
The original severity as provided by the reporting device. |
String |
| EventOriginalSubType |
The original event subtype or ID, if provided by the source. |
String |
| EventOriginalType |
The original event type or ID, if provided by the source. |
String |
| EventOriginalUid |
A unique ID of the original record, if provided by the source. |
String |
| EventOwner |
The owner of the event, which is usually the department or subsidiary in which it was generated. |
String |
| EventProduct |
The product generating the event. |
String |
| EventProductVersion |
The version of the product generating the event. |
String |
| EventReportUrl |
A URL provided in the event for a resource that provides more information about the event. |
String |
| EventResult |
The outcome of the event, represented by one of the following values: Success, Partial, Failure, NA (Not Applicable). The value may not be provided directly by the sources, in which case it is derived from other event fields, for example, the EventResultDetails field. |
String |
| EventResultDetails |
Reason or details for the result reported in the EventResult field. |
String |
| EventSchemaVersion |
The version of the schema. |
String |
| EventSeverity |
The severity of the event. Valid values are: Informational, Low, Medium, or High. |
String |
| EventStartTime |
The time (UTC) in which the event started. If the source supports aggregation and the record represents multiple events, the time that the first event was generated. If not provided by the source record, this field aliases the TimeGenerated field. |
DateTime |
| EventSubType |
Describes a subdivision of the operation reported in the EventType field. |
String |
| EventType |
Describes the operation reported by the record. |
String |
| EventUid |
A machine-readable, alphanumeric string that uniquely identifies an alert within a system. |
String |
| EventVendor |
The vendor of the product generating the event. |
String |
| FileMD5 |
MD5 hash of the file. |
String |
| FileName |
Name of the file associated with the alert, without path or a location. |
String |
| FilePath |
The full, normalized path of the target file, including the folder or location, the file name, and the extension. |
String |
| FileSHA1 |
SHA1 hash of the file. |
String |
| FileSHA256 |
SHA256 hash of the file. |
String |
| FileSize |
Size of the file in bytes. |
String |
| IndicatorAssociation |
Specifies whether the indicator is linked to or directly impacted by the threat. |
String |
| IndicatorType |
The type or category of the indicator. |
String |
| OriginalUserType |
The user type as reported by the reporting device. |
String |
| ProcessCommandLine |
Command line used to start the process. |
String |
| ProcessFileCompany |
Company that created the process image file. |
String |
| ProcessId |
The process ID (PID) associated with the alert. |
String |
| ProcessName |
Name of the process. |
String |
| RegistryKey |
The registry key associated with the alert, normalized to standard root key naming conventions. |
String |
| RegistryValue |
Registry value. |
String |
| RegistryValueData |
Data of the registry value. |
String |
| RegistryValueType |
Type of the registry value. |
String |
| Rule |
Either the value of RuleName or the value of RuleNumber. |
String |
| RuleDescription |
Description of the rule associated with the alert. |
String |
| RuleName |
The name or ID of the rule associated with the alert. |
String |
| RuleNumber |
The number of the rule associated with the alert. |
Int32 |
| SourceSystem |
|
String |
| TenantId |
Unique identifier of the tenant into which the data connector ingests data. |
String |
| ThreatCategory |
The category of the threat or malware identified in the alert. |
String |
| ThreatConfidence |
The confidence level of the threat identified, normalized to a value between 0 and a 100. |
Int32 |
| ThreatFirstReportedTime |
Date and time when the threat was first reported. |
DateTime |
| ThreatId |
The ID of the threat or malware identified in the alert. |
String |
| ThreatIsActive |
Indicates whether the threat is currently active. |
Boolean |
| ThreatLastReportedTime |
Date and time when the threat was last reported. |
DateTime |
| ThreatName |
The name of the threat or malware identified in the alert. |
String |
| ThreatOriginalCategory |
The category of the threat as reported by the originating system. |
String |
| ThreatOriginalConfidence |
The confidence level as reported by the originating system. |
String |
| ThreatOriginalRiskLevel |
The risk level as reported by the originating system. |
String |
| ThreatRiskLevel |
The risk level associated with the threat. The level should be a number between 0 and 100. |
Int32 |
| TimeGenerated |
The timestamp (UTC) reflecting the time in which the event was generated. |
DateTime |
| Type |
The name of the table |
String |
| Url |
The URL string captured in the alert. |
String |
| User |
Alias or friendly name for Username field. |
String |
| UserId |
A machine-readable, alphanumeric, unique representation of the user associated with the alert. |
String |
| UserIdType |
The type of the user ID, such as GUID, SID, or Email. |
String |
| Username |
Name of the user associated with the alert, including domain information when available. |
String |
| UsernameType |
Specifies the type of the user name stored in the Username field. |
String |
| UserScope |
The scope, such as Microsoft Entra tenant, in which UserId and Username are defined. |
String |
| UserScopeId |
The scope ID, such as Microsoft Entra Directory ID, in which UserId and Username are defined. |
String |
| UserSessionId |
The unique ID of the user’s session associated with the alert. |
String |
| UserType |
The type of the Actor. |
String |