Skip to content

Commit 0806006

Browse files
yelevinyelevin
committed
Second draft, plus TOC
1 parent 539022b commit 0806006

File tree

2 files changed

+48
-37
lines changed

2 files changed

+48
-37
lines changed

‎articles/sentinel/TOC.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -320,6 +320,8 @@
320320
items:
321321
- name: Data source schema reference
322322
href: data-source-schema-reference.md
323+
- name: Security alert schema reference
324+
href: security-alert-schema.md
323325
- name: CEF log field mapping
324326
href: cef-name-mapping.md
325327
- name: Normalization

‎articles/sentinel/security-alert-schema.md

Lines changed: 46 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ cloud: na
66
documentationcenter: na
77
author: yelevin
88
ms.topic: reference
9-
ms.date: 11/17/2021
9+
ms.date: 01/11/2022
1010
ms.author: yelevin
1111

1212
---
@@ -15,46 +15,55 @@ ms.author: yelevin
1515

1616
[!INCLUDE [Banner for top of topics](./includes/banner.md)]
1717

18-
This article lists supported Azure and third-party data source schemas, with links to their reference documentation.
18+
Microsoft Sentinel [analytics rules](detect-threats-built-in.md) create incidents as the result of **security alerts**. Security alerts can come from different sources, and accordingly use different kinds of analytics rules to create incidents:
19+
20+
- **Scheduled** analytics rules generate alerts as the result of their regular queries of data in logs ingested from external sources, and those same rules create incidents from those alerts. (For the purposes of this document, "scheduled" rule alerts include **NRT rule alerts**.)
21+
22+
- **Microsoft Security** analytics rules create incidents from alerts that are ingested as-is from other Microsoft security products, for example, Microsoft 365 Defender and Microsoft Defender for Cloud.
23+
24+
Regardless of the source, these alerts are all stored together in the *SecurityAlert* table in your Log Analytics workspace. This article describes the schema of this table.
25+
26+
Because alerts come from many sources, not all fields are used by all providers. Some fields may be left blank.
1927

2028
## Schema definitions
2129

22-
| Column Name | Type | Descrption | Yechiel's Comments |
30+
| Column Name | Type | Description | *Questions* |
2331
| --- | --- | --- | --- |
24-
| **AlertLink** | string | Link to the alert in the portal of the originating product. | |
25-
| **AlertName** | string | Display name of the alert. For scheduled rules, it will be taken from the rule name. | ASC wanted to deprecate one (display and alert name) but left the 2 <br>For non-scheduled rules, what will this say? |
26-
| **AlertSeverity** | string | Severity of the alert (informational, low, medium, high). | |
27-
| **AlertType** | string | The type of alert. Alerts of the same type should have the same name. For scheduled rules, this will be populated by the rule ID. | For other rule types, what is this? The alert type (anomaly, NRT, Microsoft Security, etc.)? |
28-
| **CompromisedEntity** | string | Display name of the main entity being alerted on. | |
29-
| **ConfidenceLevel** | string | The confidence level of this alert: how sure the provider is that this is not a false positive. | |
30-
| **ConfidenceScore** | real | The confidence score of the alert, if applicable. This property allows for a more fine-grained representation of the confidence level of the alert compared to the ConfidenceLevel field. Valid values are in the range of 0.0-1.0 (inclusive). | |
31-
| **Description** | string | The description of the alert. | |
32-
| **DisplayName** | string | Display name of the alert. For scheduled rules it will be taken from the rule name. | ASC wanted to deprecate one (display and alert name) but left the 2 |
33-
| **EndTime** | datetime | The end time of the impact of the alert (the time of the last event or activity included in the alert). For scheduled rule alerts, this is the value of the TimeGenerated field for the last event captured by the query. | |
34-
| **Entities** | string | A list of entities related to the alert. This list can include a combination of entities of different types. The entities' types can be any of those defined in the [documentation](entities-reference.md). | |
35-
| **ExtendedLinks** | string | A bag (a collection) for all links related to the alert. This bag can include a combination of links of different types. | |
36-
| **ExtendedProperties** | string | A collection of other properties of the alert, including user-defined properties. Any custom details defined in the alert, and any dynamic content in the alert details, are stored here. | |
37-
| **IsIncident** | boolean | DEPRECATED. Will always be set to *false*. | was used before for ASC they had Alert (incident) and alert |
38-
| **ProcessingEndTime** | datetime | The time of the alert's publishing. For scheduled rule alerts, this is the value of the TimeGenerated field. | |
39-
| **ProductComponentName** | string | The name of the component of the product that generated the alert. | |
40-
| **ProductName** | string | The name of the product that published the alert. | |
41-
| **ProviderName** | string | The name of the alert provider ***------------------(e.g. Scheduled alert - ASI Scheduled Alerts, NRT - ASI NRT Alerts, Azure defender - Azure Security Center)------------------*** | This needs to be better differentiated from ProductName. Maybe a footnote (or a cross-reference) explaining what an alert provider is? |
42-
| **RemediationSteps** | string | Manual action items to take to remediate the alert. | |
43-
| **ResourceId** | string | A unique identifier for the resource that the alert is associated with. | |
44-
| **SourceComputerId** | string | DEPRECATED. Was the agent ID that created the alert. | |
45-
| **SourceSystem** | string | DEPRECATED. Will always be populated with the string "Detection". | Not to document? Because deprecated? |
46-
| **StartTime** | datetime | The start time of the impact of the alert (the time of the first event or activity included in the alert). For scheduled rule alerts, this is the value of the TimeGenerated field for the first event captured by the query. | |
47-
| **Status** | string | The status of the alert within the life cycle. [New / InProgress / Resolved / Dismissed / Unknown] | |
48-
| **SystemAlertId** | string | Internal unique ID for the alert in Sentinel. | |
49-
| **Tactics** | string | MITRE tactics associated with the alert, in comma-separated list form. | |
50-
| **TenantId** | string | Unique ID of the tenant. | Not to document |
51-
| **TimeGenerated** | datetime | The time the alert was generated (in UTC). | |
52-
| **Type** | string | The name of the table. | |
53-
| **VendorName** | string | The vendor of the product that produces the alert. | Is this ever anything besides the manufacturer of ProductName/ProviderName? |
54-
| **VendorOriginalId** | string | Unique id for the specific alert instance set by the provider. | |
55-
| **WorkspaceResourceGroup** | string | The Azure resource group for the Log Analytics workspace storing this alert | DEPRECATED |
56-
| **WorkspaceSubscriptionId** | string | The Azure subscription ID for the Log Analytics workspace storing this alert | DEPRECATED |
57-
| | | | |
32+
| **AlertLink** | string | A link to the alert in the portal of the originating product. |
33+
| **AlertName** | string | The display name of the alert. <ul><li>**Scheduled rule alerts:** taken from the rule name.<li>**Ingested alerts:** the display name of the alert in the originating product. | Check for correctness |
34+
| **AlertSeverity** | string | The severity of the alert. [Informational / Low / Medium / High] |
35+
| **AlertType** | string | The type of alert. <ul><li>**Scheduled rule alerts:** taken from the rule ID.<li>**Ingested alerts:** some products group their alerts by type. In some cases, may be identical to or synonymous with the product name. | Check for correctness |
36+
| **CompromisedEntity** | string | The display name of the main entity being alerted on. |
37+
| **ConfidenceLevel** | string | The confidence level of this alert: how sure the provider is that this is not a false positive. |
38+
| **ConfidenceScore** | real | The confidence score of the alert, on a scale of 0.0-1.0, if applicable. This property allows for a more fine-grained representation of the confidence level of the alert compared to the ConfidenceLevel field. |
39+
| **Description** | string | The description of the alert. |
40+
| **DisplayName** | string | The display name of the alert. Synonymous with **AlertName** but retained for compatibility. | Check for correctness |
41+
| **EndTime** | datetime | The end time of the impact of the alert. <ul><li>**Scheduled rule alerts:** the value of the TimeGenerated field for the last *event* captured by the query.<li>**Ingested alerts:** the time of the last event or activity included in the alert. | Check for correctness |
42+
| **Entities** | string | A list of the entities identified in the alert. This list can include a combination of entities of different types. The entities' types can be any of those defined in the schema, as described in the [entities documentation](entities-reference.md). | Can entities be identified in ingested alerts, or only in scheduled alerts that have entity mapping? |
43+
| **ExtendedLinks** | string | A bag (a collection) for all links related to the alert. This bag can include a combination of links of different types. |
44+
| **ExtendedProperties** | string | A collection of other properties of the alert, including user-defined properties. Any [custom details](surface-custom-details-in-alerts.md) defined in the alert, and any dynamic content in the [alert details](customize-alert-details.md), are stored here. | |
45+
| **IsIncident** | boolean | DEPRECATED. Always set to *false*. |
46+
| **ProcessingEndTime** | datetime | The time of the alert's publishing. For scheduled rule alerts, this is the value of the TimeGenerated field. | For ingested alerts, what is it? The ingestion time? How is it differentiated from *TimeGenerated*? |
47+
| **ProductComponentName** | string | The name of the component of the product that generated the alert. | Example of how this is different than *ProviderName*? |
48+
| **ProductName** | string | The name of the product that generated the alert. |
49+
| **ProviderName** | string | The name of the alert provider - the service within the product - that generated the alert. | Example of how this is different than *ProductComponentName*? |
50+
| **RemediationSteps** | string | A list of action items to take to remediate the alert. |
51+
| **ResourceId** | string | A unique identifier for the resource that is the subject of the alert. |
52+
| **SourceComputerId** | string | DEPRECATED. Was the agent ID on the server that created the alert. |
53+
| **SourceSystem** | string | DEPRECATED. Always populated with the string "Detection". |
54+
| **StartTime** | datetime | The start time of the impact of the alert. <ul><li>**Scheduled rule alerts:** the value of the *TimeGenerated* field for the first *event* captured by the query.<li>**Ingested alerts:** the time of the first event or activity included in the alert. | Check for correctness |
55+
| **Status** | string | The status of the alert within the life cycle. [New / InProgress / Resolved / Dismissed / Unknown] |
56+
| **SystemAlertId** | string | The internal unique ID for the alert in Microsoft Sentinel. |
57+
| **Tactics** | string | A comma-delineated list of MITRE ATT&CK tactics associated with the alert. |
58+
| **Techniques** | string | A comma-delineated list of MITRE ATT&CK techniques associated with the alert. |
59+
| **TenantId** | string | The unique ID of the tenant. |
60+
| **TimeGenerated** | datetime | The time the alert was generated (in UTC). | Also for ingested alerts? Or is it the ingestion time for those? |
61+
| **Type** | string | The constant ('SecurityAlert') | Check for correctness |
62+
| **VendorName** | string | The vendor of the product that produced the alert. |
63+
| **VendorOriginalId** | string | Unique ID for the specific alert instance, set by the originating product. |
64+
| **WorkspaceResourceGroup** | string | DEPRECATED. Was the Azure resource group of the Log Analytics workspace containing the resource that generated the alert. | Check for correctness |
65+
| **WorkspaceSubscriptionId** | string | DEPRECATED. Was the Azure subscription ID of the Log Analytics workspace containing the resource that generated the alert | Check for correctness |
66+
| | | |
5867

5968
## Next steps
6069

0 commit comments

Comments
 (0)