XDR ReferenceSchema and PowerShell module
← Browse all tables
Loading table information…

Structured examples

Contribute a synthetic example using PowerShell or an export from the hunting portal. Contributions are reviewed before publication.

These examples use synthetic values and cover only some possible event variants. Use them as a reference, never as ground truth or a complete schema. Fields can vary between events; a field shown here is not necessarily required.

AdditionalFields

Submit an example

Action: a92140f2-6700-3d7a-a7a0-9519097a1383

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "IngestionTime": "2026-01-01T00:00:00Z",
  "ShouldNotCalculateAlertId": false
}

Payload fields and types
PathType
$object
$.IngestionTimestring
$.ShouldNotCalculateAlertIdboolean

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: e9a82da0-8f67-6bf6-a147-e539299e11b8

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "IngestionTime": "2026-01-01T00:00:00Z",
  "ShouldNotCalculateAlertId": false
}

Payload fields and types
PathType
$object
$.IngestionTimestring
$.ShouldNotCalculateAlertIdboolean

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: 32f975f8-74a8-0970-44e6-6ec29c958134

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "IngestionTime": "2026-01-01T00:00:00Z",
  "ShouldNotCalculateAlertId": false
}

Payload fields and types
PathType
$object
$.IngestionTimestring
$.ShouldNotCalculateAlertIdboolean

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: 9f651690-6443-3ed3-5f3a-ad38332d9c3f

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "IngestionTime": "2026-01-01T00:00:00Z",
  "ShouldNotCalculateAlertId": false
}

Payload fields and types
PathType
$object
$.IngestionTimestring
$.ShouldNotCalculateAlertIdboolean

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: 1f496f27-d55b-6586-9b22-5014576b9a86

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "IngestionTime": "2026-01-01T00:00:00Z",
  "ShouldNotCalculateAlertId": false
}

Payload fields and types
PathType
$object
$.IngestionTimestring
$.ShouldNotCalculateAlertIdboolean

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: 24d33246-93fa-1400-716f-5a6a0b7bb6bd

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "IngestionTime": "2026-01-01T00:00:00Z"
}

Payload fields and types
PathType
$object
$.IngestionTimestring

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.