Skip to content

Commit 137eb41

Browse files
ShannonLeavittShannonLeavitt
authored
Merge pull request #183326 from yelevin/yelevin/security-alert-schema
Security alert schema
2 parents 7e134d7 + 2dfac0d commit 137eb41

File tree

2 files changed

+78
-0
lines changed

2 files changed

+78
-0
lines changed

‎articles/sentinel/TOC.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -360,6 +360,8 @@
360360
items:
361361
- name: Data source schema reference
362362
href: data-source-schema-reference.md
363+
- name: Security alert schema reference
364+
href: security-alert-schema.md
363365
- name: CEF log field mapping
364366
href: cef-name-mapping.md
365367
- name: Windows security event sets

‎articles/sentinel/security-alert-schema.md

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
---
2+
title: Microsoft Sentinel security alert schema reference
3+
description: This article displays the schema of security alerts in Microsoft Sentinel.
4+
services: sentinel
5+
cloud: na
6+
documentationcenter: na
7+
author: yelevin
8+
ms.topic: reference
9+
ms.date: 01/11/2022
10+
ms.author: yelevin
11+
12+
---
13+
14+
# Microsoft Sentinel security alert schema reference
15+
16+
[!INCLUDE [Banner for top of topics](./includes/banner.md)]
17+
18+
Microsoft Sentinel [analytics rules](detect-threats-built-in.md) create incidents as the result of **security alerts**. Security alerts can come from different sources, and accordingly use different kinds of analytics rules to create incidents:
19+
20+
- **Scheduled** analytics rules generate alerts as the result of their regular queries of data in logs ingested from external sources, and those same rules create incidents from those alerts. (For the purposes of this document, "scheduled" rule alerts include **NRT rule alerts**.)
21+
22+
- **Microsoft Security** analytics rules create incidents from alerts that are ingested as-is from other Microsoft security products, for example, Microsoft 365 Defender and Microsoft Defender for Cloud.
23+
24+
Regardless of the source, these alerts are all stored together in the *SecurityAlert* table in your Log Analytics workspace. This article describes the schema of this table.
25+
26+
Because alerts come from many sources, not all fields are used by all providers. Some fields may be left blank.
27+
28+
## Schema definitions
29+
30+
| Column Name | Type | Description |
31+
| --- | --- | --- |
32+
| **AlertLink** | string | A link to the alert in the portal of the originating product. |
33+
| **AlertName** | string | The display name of the alert. <ul><li>**Scheduled rule alerts:** taken from the rule name.<li>**Ingested alerts:** the display name of the alert in the originating product. |
34+
| **AlertSeverity** | string | The severity of the alert. [Informational / Low / Medium / High] |
35+
| **AlertType** | string | The type of alert. <ul><li>**Scheduled rule alerts:** taken from the rule ID.<li>**Ingested alerts:** some products group their alerts by type. In some cases, may be identical to or synonymous with the product name. |
36+
| **CompromisedEntity** | string | The display name of the main entity being alerted on. |
37+
| **ConfidenceLevel** | string | The confidence level of this alert: how sure the provider is that this is not a false positive. |
38+
| **ConfidenceScore** | real | The confidence score of the alert, on a scale of 0.0-1.0, if applicable. This property allows for a more fine-grained representation of the confidence level of the alert compared to the ConfidenceLevel field. |
39+
| **Description** | string | The description of the alert. |
40+
| **DisplayName** | string | The display name of the alert. Synonymous with *AlertName* but retained for compatibility. |
41+
| **EndTime** | datetime | The end time of the impact of the alert. <ul><li>**Scheduled rule alerts:** the value of the *TimeGenerated* field for the last *event* captured by the query.<li>**Ingested alerts:** the time of the last event or activity included in the alert. |
42+
| **Entities** | string | A list of the entities identified in the alert. This list can include a combination of entities of different types. The entities' types can be any of those defined in the schema, as described in the [entities documentation](entities-reference.md). |
43+
| **ExtendedLinks** | string | A bag (a collection) for all links related to the alert. This bag can include a combination of links of different types. |
44+
| **ExtendedProperties** | string | A collection of other properties of the alert, including user-defined properties. Any [custom details](surface-custom-details-in-alerts.md) defined in the alert, and any dynamic content in the [alert details](customize-alert-details.md), are stored here. |
45+
| **IsIncident** | boolean | DEPRECATED. Always set to *false*. |
46+
| **ProcessingEndTime** | datetime | The time of the alert's publishing. <ul><li>**Scheduled rule alerts:** the value of the *TimeGenerated* field.<li>**Ingested alerts:** the time that the originating product completes the production of the alert. |
47+
| **ProductComponentName** | string | The name of the component of the product that generated the alert. |
48+
| **ProductName** | string | The name of the product that generated the alert. |
49+
| **ProviderName** | string | The name of the alert provider (the service within the product) that generated the alert. |
50+
| **RemediationSteps** | string | A list of action items to take to remediate the alert. |
51+
| **ResourceId** | string | A unique identifier for the resource that is the subject of the alert. |
52+
| **SourceComputerId** | string | DEPRECATED. Was the agent ID on the server that created the alert. |
53+
| **SourceSystem** | string | DEPRECATED. Always populated with the string "Detection". |
54+
| **StartTime** | datetime | The start time of the impact of the alert. <ul><li>**Scheduled rule alerts:** the value of the *TimeGenerated* field for the first *event* captured by the query.<li>**Ingested alerts:** the time of the first event or activity included in the alert. |
55+
| **Status** | string | The status of the alert within the life cycle. [New / InProgress / Resolved / Dismissed / Unknown] |
56+
| **SystemAlertId** | string | The internal unique ID for the alert in Microsoft Sentinel. |
57+
| **Tactics** | string | A comma-delineated list of MITRE ATT&CK tactics associated with the alert. |
58+
| **Techniques** | string | A comma-delineated list of MITRE ATT&CK techniques associated with the alert. |
59+
| **TenantId** | string | The unique ID of the tenant. |
60+
| **TimeGenerated** | datetime | The time the alert was generated (in UTC). |
61+
| **Type** | string | The constant ('SecurityAlert') |
62+
| **VendorName** | string | The vendor of the product that produced the alert. |
63+
| **VendorOriginalId** | string | Unique ID for the specific alert instance, set by the originating product. |
64+
| **WorkspaceResourceGroup** | string | DEPRECATED |
65+
| **WorkspaceSubscriptionId** | string | DEPRECATED |
66+
| | | |
67+
68+
## Next steps
69+
70+
Learn more about security alerts and analytics rules:
71+
72+
- [Detect threats out-of-the-box](detect-threats-built-in.md)
73+
74+
- [Create custom analytics rules to detect threats](detect-threats-custom.md)
75+
76+
- [Export and import analytics rules to and from ARM templates](import-export-analytics-rules.md)

0 commit comments

Comments
 (0)