Skip to content

Commit 94a7522

Browse files
authored
Update how-to-forward-alert-information-to-partners.md
------- cc: @batamig
1 parent cc37fef commit 94a7522

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

articles/defender-for-iot/organizations/how-to-forward-alert-information-to-partners.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -136,8 +136,8 @@ Enter the following parameters:
136136
| Syslog CEF output format | Description |
137137
|--|--|
138138
| Priority | User.Alert |
139-
| Date and time | Date and time that the syslog server machine received the information. (Added by Syslog server) |
140-
| Hostname | Sensor hostname (Added by Syslog server) |
139+
| Date and time | Date and time that sensor sent the information |
140+
| Hostname | Sensor hostname |
141141
| Message | CEF:0 <br />Microsoft Defender for IoT/CyberX <br />Sensor name <br />Sensor version <br />Microsoft Defender for IoT Alert <br />Alert title <br />Integer indication of serverity. 1=**Warning**, 4=**Minor**, 8=**Major**, or 10=**Critical**.<br />msg= The message of the alert. <br />protocol= The protocol of the alert. <br />severity= **Warning**, **Minor**, **Major**, or **Critical**. <br />type= **Protocol Violation**, **Policy Violation**, **Malware**, **Anomaly**, or **Operational**. <br />UUID= UUID of the alert <br /> start= The time that the alert was detected. <br />Might vary from the time of the syslog server machine, and depends on the time-zone configuration of the forwarding rule. <br />src_ip= IP address of the source device. <br />src_mac= MAC address of the source device. (Optional) <br />dst_ip= IP address of the destination device.<br />dst_mac= MAC address of the destination device. (Optional)<br />cat= The alert group associated with the alert. |
142142

143143
| Syslog LEEF output format | Description |

0 commit comments

Comments
 (0)