Alerts from Microsoft Defender for Endpoint, Microsoft Defender for Office 365, Microsoft Cloud App Security, and Microsoft Defender for Identity, including severity information and threat categorization
Defender
Table retention
ColdDays
HotDays
TotalInteractiveDays
0
30
30
Schema
Name
Description
Type
AlertId
Unique identifier for the alert
String
AttackTechniques
MITRE ATT&CK techniques associated with the activity that triggered the alert
String
Category
Type of threat indicator or breach activity identified by the alert
String
DetectionSource
Detection technology or sensor that identified the notable component or activity
String
MachineGroup
String
SentinelWorkspaceIds
The unique identifiers of the Microsoft Sentinel workspace this alert is associated with
String
ServiceSource
Product or service that provided the alert information
String
Severity
Indicates the potential impact (high, medium, or low) of the threat indicator or breach activity identified by the alert