Skip to content

Commit 5c2709f

Browse files
memildinmemildin
committed
Final corrections to the alerts schema page
1 parent e435f86 commit 5c2709f

File tree

2 files changed

+59
-49
lines changed

2 files changed

+59
-49
lines changed

‎articles/security-center/alerts-schemas.md

Lines changed: 14 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -23,9 +23,9 @@ These alerts are only available to users of the standard tier.
2323

2424
Security alerts can be seen in Azure Security Center's Threat Protection pages. They can also be accessed from:
2525

26-
- [Azure Sentinel](https://docs.microsoft.com/azure/sentinel/) (or any other SIEM)
26+
- [Azure Sentinel](https://docs.microsoft.com/azure/sentinel/)
2727

28-
- [Azure Event Hubs](https://docs.microsoft.com/azure/event-hubs/) using Security Center's [continuous export feature](continuous-export.md)
28+
- [Azure Event Hubs](https://docs.microsoft.com/azure/event-hubs/) using Security Center's [continuous export feature](continuous-export.md) for integrations with third-party SIEMs
2929

3030
- [The REST API](https://docs.microsoft.com/rest/api/securitycenter/) - If you're using the REST API to access alerts, see the [online Alerts API documentation](https://docs.microsoft.com/rest/api/securitycenter/alerts)
3131

@@ -42,7 +42,7 @@ If you're using any programmatic methods to consume the alerts, you'll need the
4242

4343
### [Workflow automation](#tab/schema-workflowautomation)
4444

45-
### Sample JSON for alerts sent to Workflow automation or a 3rd-party SIEM
45+
### Sample JSON for alerts sent to workflow automation
4646

4747
This is the schema of the alert events passed to Logic App instances that were configured in Security Center's workflow automation. For more information about the workflow automation feature see [Automate responses to alerts and recommendations](workflow-automation.md).
4848

@@ -51,10 +51,9 @@ This is the schema of the alert events passed to Logic App instances that were c
5151

5252

5353

54-
5554
### [Continuous export to Event Hub](#tab/schema-continuousexport)
5655

57-
### Sample JSON for alerts sent with continuous export to Event Hub
56+
### Sample JSON for alerts sent with continuous export to Event Hub and third-party SIEMs
5857

5958
This is the schema of the alert events passed to an Event Hub using the Security Center's continuous export feature. For more information about continuous export, see [Export alerts and recommendations](continuous-export.md).
6059

@@ -63,19 +62,23 @@ This is the schema of the alert events passed to an Event Hub using the Security
6362

6463

6564

65+
### [Azure Sentinel](#tab/schema-sentinel)
6666

67+
The Sentinel Connector gets alerts from Azure Security Center and sends them to the Log Analytics Workspace for Azure Sentinel.
6768

69+
To create a Sentinel case or incident using Security Center alerts, you'll need the schema for those alerts shown below.
6870

71+
> [!TIP]
72+
> For more information about Azure Sentinel, see [the documentation](https://docs.microsoft.com/azure/sentinel/).
6973
70-
### [Azure Sentinel](#tab/schema-sentinel)
74+
[!INCLUDE [Sentinel and workspace schema](../../includes/security-center-alerts-schema-loganalyticsworkspace.md)]
7175

72-
This is the schema for alerts sent to Azure Sentinel.
7376

74-
For more information about Azure Sentinel, see [the documentation](https://docs.microsoft.com/azure/sentinel/).
7577

76-
### Sample JSON for alerts sent to Workflow Automation, Event Hub, Azure Sentinel or other SIEMs
7778

78-
[!INCLUDE [Workflow schema](../../includes/security-center-alerts-schema-workflowautomation.md)]
79+
### [Workspace](#tab/schema-workspace)
80+
81+
[!INCLUDE [Sentinel and workspace schema](../../includes/security-center-alerts-schema-loganalyticsworkspace.md)]
7982

8083

8184

@@ -179,44 +182,6 @@ You can easily view the security alerts events in Activity log by searching for
179182

180183

181184

182-
### [Workspace](#tab/schema-workspace)
183-
184-
### The data model of the schema
185-
186-
|Field|Description|
187-
|----|----|
188-
|**AlertName**|Alert display name|
189-
|**Severity**|The alert severity (High/Medium/Low/Informational)|
190-
|**AlertType**|unique alert identifier|
191-
|**ConfidenceLevel**|(Optional) The confidence level of this alert (High/Low)|
192-
|**ConfidenceScore**|(Optional) Numeric confidence indicator of the security alert|
193-
|**Description**|Description text for the alert|
194-
|**DisplayName**|The alert's display name|
195-
|**EndTime**|The impact end time of the alert (the time of the last event contributing to the alert)|
196-
|**Entities**|A list of entities related to the alert. This list can hold a mixture of entities of diverse types|
197-
|**ExtendedLinks**|(Optional) A bag for all links related to the alert. This bag can hold a mixture of links for diverse types|
198-
|**ExtendedProperties**|A bag of additional fields which are relevant to the alert|
199-
|**IsIncident**|Determines if the alert is an incident or a regular alert. An incident is a security alert that aggregates multiple alerts into one security incident|
200-
|**ProcessingEndTime**|UTC timestamp in which the alert was created|
201-
|**ProductComponentName**|(Optional) The name of a component inside the product which generated the alert.|
202-
|**ProductName**|constant ('Azure Security Center')|
203-
|**ProviderName**|unused|
204-
|**RemediationSteps**|Manual action items to take to remediate the security threat|
205-
|**ResourceId**|Full identifier of the affected resource|
206-
|**SourceComputerId**|a unique GUID for the affected server (if the alert is generated on the server)|
207-
|**SourceSystem**|unused|
208-
|**StartTime**|The impact start time of the alert (the time of the first event contributing to the alert)|
209-
|**SystemAlertId**|Unique identifier of this security alert instance|
210-
|**TenantId**|the identifier of the parent Azure Active directory tenant of the subscription under which the scanned resource resides|
211-
|**TimeGenerated**|UTC timestamp on which the assessment took place (Security Center's scan time) (identical to DiscoveredTimeUTC)|
212-
|**Type**|constant ('SecurityAlert')|
213-
|**VendorName**|The name of the vendor that provided the alert (e.g. 'Microsoft')|
214-
|**VendorOriginalId**|unused|
215-
|**WorkspaceResourceGroup**|in case the alert is generated on a VM, Server, Virtual Machine Scale Set or App Service instance that reports to a workspace, contains that workspace resource group name|
216-
|**WorkspaceSubscriptionId**|in case the alert is generated on a VM, Server, Virtual Machine Scale Set or App Service instance that reports to a workspace, contains that workspace subscriptionId|
217-
|||
218-
219-
220185

221186

222187
### [MS Graph API](#tab/schema-graphapi)
@@ -225,4 +190,4 @@ Microsoft Graph is the gateway to data and intelligence in Microsoft 365. It pro
225190

226191
The schema and a JSON representation for security alerts sent to MS Graph, are available in [the Microsoft Graph documentation](https://docs.microsoft.com/graph/api/resources/alert?view=graph-rest-1.0).
227192

228-
---
193+
---

‎includes/security-center-alerts-schema-loganalyticsworkspace.md

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
---
2+
title: include file
3+
description: include file
4+
services: data-factory
5+
author: memildin
6+
ms.service: data-factory
7+
ms.topic: include
8+
ms.date: 03/17/2020
9+
ms.author: memildin
10+
ms.custom: include file
11+
---
12+
### The data model of the schema
13+
14+
|Field|Description|
15+
|----|----|
16+
|**AlertName**|Alert display name|
17+
|**Severity**|The alert severity (High/Medium/Low/Informational)|
18+
|**AlertType**|unique alert identifier|
19+
|**ConfidenceLevel**|(Optional) The confidence level of this alert (High/Low)|
20+
|**ConfidenceScore**|(Optional) Numeric confidence indicator of the security alert|
21+
|**Description**|Description text for the alert|
22+
|**DisplayName**|The alert's display name|
23+
|**EndTime**|The impact end time of the alert (the time of the last event contributing to the alert)|
24+
|**Entities**|A list of entities related to the alert. This list can hold a mixture of entities of diverse types|
25+
|**ExtendedLinks**|(Optional) A bag for all links related to the alert. This bag can hold a mixture of links for diverse types|
26+
|**ExtendedProperties**|A bag of additional fields which are relevant to the alert|
27+
|**IsIncident**|Determines if the alert is an incident or a regular alert. An incident is a security alert that aggregates multiple alerts into one security incident|
28+
|**ProcessingEndTime**|UTC timestamp in which the alert was created|
29+
|**ProductComponentName**|(Optional) The name of a component inside the product which generated the alert.|
30+
|**ProductName**|constant ('Azure Security Center')|
31+
|**ProviderName**|unused|
32+
|**RemediationSteps**|Manual action items to take to remediate the security threat|
33+
|**ResourceId**|Full identifier of the affected resource|
34+
|**SourceComputerId**|a unique GUID for the affected server (if the alert is generated on the server)|
35+
|**SourceSystem**|unused|
36+
|**StartTime**|The impact start time of the alert (the time of the first event contributing to the alert)|
37+
|**SystemAlertId**|Unique identifier of this security alert instance|
38+
|**TenantId**|the identifier of the parent Azure Active directory tenant of the subscription under which the scanned resource resides|
39+
|**TimeGenerated**|UTC timestamp on which the assessment took place (Security Center's scan time) (identical to DiscoveredTimeUTC)|
40+
|**Type**|constant ('SecurityAlert')|
41+
|**VendorName**|The name of the vendor that provided the alert (e.g. 'Microsoft')|
42+
|**VendorOriginalId**|unused|
43+
|**WorkspaceResourceGroup**|in case the alert is generated on a VM, Server, Virtual Machine Scale Set or App Service instance that reports to a workspace, contains that workspace resource group name|
44+
|**WorkspaceSubscriptionId**|in case the alert is generated on a VM, Server, Virtual Machine Scale Set or App Service instance that reports to a workspace, contains that workspace subscriptionId|
45+
|||

0 commit comments

Comments
 (0)