XDR ReferenceSchema and PowerShell tools
← Browse all tables
Loading table information…

Structured examples

Contribute a synthetic example using PowerShell or an export from the hunting portal. Contributions are reviewed before publication.

Submit an example for AdditionalFields

These examples use synthetic values and cover only some possible event variants. Use them as a reference, never as ground truth or a complete schema. Fields can vary between events; a field shown here is not necessarily required.

AdditionalFields

Action: a92140f2-6700-3d7a-a7a0-9519097a1383

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "IngestionTime": "2026-01-01T00:00:00Z",
  "ShouldNotCalculateAlertId": false
}

Payload fields and types

PathType
$object
$.IngestionTimestring
$.ShouldNotCalculateAlertIdboolean

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: e9a82da0-8f67-6bf6-a147-e539299e11b8

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "IngestionTime": "2026-01-01T00:00:00Z",
  "ShouldNotCalculateAlertId": false
}

Payload fields and types

PathType
$object
$.IngestionTimestring
$.ShouldNotCalculateAlertIdboolean

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: 32f975f8-74a8-0970-44e6-6ec29c958134

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "IngestionTime": "2026-01-01T00:00:00Z",
  "ShouldNotCalculateAlertId": false
}

Payload fields and types

PathType
$object
$.IngestionTimestring
$.ShouldNotCalculateAlertIdboolean

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: 9f651690-6443-3ed3-5f3a-ad38332d9c3f

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "IngestionTime": "2026-01-01T00:00:00Z",
  "ShouldNotCalculateAlertId": false
}

Payload fields and types

PathType
$object
$.IngestionTimestring
$.ShouldNotCalculateAlertIdboolean

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: 1f496f27-d55b-6586-9b22-5014576b9a86

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "IngestionTime": "2026-01-01T00:00:00Z",
  "ShouldNotCalculateAlertId": false
}

Payload fields and types

PathType
$object
$.IngestionTimestring
$.ShouldNotCalculateAlertIdboolean

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: 24d33246-93fa-1400-716f-5a6a0b7bb6bd

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "IngestionTime": "2026-01-01T00:00:00Z"
}

Payload fields and types

PathType
$object
$.IngestionTimestring

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.