You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The following is a more in-depth look at the full schemas of each entity type. You'll notice that many of these schemas include links to other entity types - for example, the User account schema includes a link to the Host entity type, as one attribute of a user account is the host it's defined on. These externally-linked entities can't be used as identifiers for entity mapping, but they are very useful in giving a complete picture of entities on entity pages and the investigation graph.
48
+
The following is a more in-depth look at the full schemas of each entity type. You'll notice that many of these schemas include links to other entity types - for example, the User account schema includes a link to the Host entity type, as one attribute of a user account is the host it's defined on. These externallylinked entities can't be used as identifiers for entity mapping, but they are very useful in giving a complete picture of entities on entity pages and the investigation graph.
49
49
50
50
> [!NOTE]
51
51
> A question mark following the value in the **Type** column indicates the field is nullable.
@@ -70,7 +70,6 @@ The following is a more in-depth look at the full schemas of each entity type. Y
70
70
| IsDomainJoined | Bool? | Determines whether this is a domain account. |
71
71
| DisplayName | String | The display name of the account. |
72
72
| ObjectGuid | Guid? | The objectGUID attribute is a single-value attribute that is the unique identifier for the object, assigned by Active Directory. |
73
-
|
74
73
75
74
Strong identifiers of an account entity:
76
75
@@ -104,7 +103,6 @@ Weak identifiers of an account entity:
104
103
| OSFamily | Enum? | One of the following values: <li>Linux<li>Windows<li>Android<li>IOS |
105
104
| OSVersion | String | A free-text representation of the operating system.<br>This field is meant to hold specific versions the are more fine-grained than OSFamily, or future values not supported by OSFamily enumeration. |
106
105
| IsDomainJoined | Bool | Determines whether this host belongs to a domain. |
107
-
|
108
106
109
107
Strong identifiers of a host entity:
110
108
- HostName + NTDomain
@@ -128,7 +126,6 @@ Weak identifiers of a host entity:
128
126
| Type | String | ‘ip’ |
129
127
| Address | String | The IP address as string, e.g. 127.0.0.1 (either in IPv4 or IPv6). |
130
128
| Location | GeoLocation | The geo-location context attached to the IP entity. <br><br>For more information, see also [Enrich entities in Microsoft Sentinel with geolocation data via REST API (Public preview)](geolocation-data-api.md). |
131
-
|
132
129
133
130
Strong identifiers of an IP entity:
134
131
- Address
@@ -142,7 +139,6 @@ Strong identifiers of an IP entity:
142
139
| Category | String | The malware category by the vendor, e.g. Trojan. |
143
140
| Files | List\<Entity> | List of linked file entities on which the malware was found. Can contain the File entities inline or as reference.<br>See the File entity for additional details on structure. |
144
141
| Processes | List\<Entity> | List of linked process entities on which the malware was found. This would often be used when the alert triggered on fileless activity.<br>See the [Process](#process) entity for additional details on structure. |
145
-
|
146
142
147
143
Strong identifiers of a malware entity:
148
144
@@ -157,7 +153,6 @@ Strong identifiers of a malware entity:
157
153
| Name | String | The file name without the path (some alerts might not include path). |
158
154
| Host | Entity | The host on which the file was stored. |
159
155
| FileHashes | List<Entity>| The file hashes associated with this file. |
160
-
|
161
156
162
157
Strong identifiers of a file entity:
163
158
- Name + Directory
@@ -178,7 +173,6 @@ Strong identifiers of a file entity:
178
173
| ParentProcess | Entity (Process) | The parent process entity. <br>Can contain partial data, i.e. only the PID. |
179
174
| Host | Entity | The host on which the process was running. |
180
175
| LogonSession | Entity (HostLogonSession) | The session in which the process was running. |
181
-
|
182
176
183
177
Strong identifiers of a process entity:
184
178
@@ -202,7 +196,6 @@ Weak identifiers of a process entity:
202
196
| AppId | Int | The technical identifier of the application. This should be one of the values defined in the list of [cloud application identifiers](#cloud-application-identifiers). The value for AppId field is optional. |
203
197
| Name | String | The name of the related cloud application. The value of application name is optional. |
204
198
| InstanceName | String | The user-defined instance name of the cloud application. It is often used to distinguish between several applications of the same type that a customer has. |
205
-
|
206
199
207
200
Strong identifiers of a cloud application entity:
208
201
- AppId (without InstanceName)
@@ -221,7 +214,6 @@ Strong identifiers of a cloud application entity:
221
214
| IpAddress | List<Entity (IP)>| Entities corresponding to the resolved IP addresses. |
222
215
| DnsServerIp | Entity (IP) | An entity representing the DNS server resolving the request. |
223
216
| HostIpAddress | Entity (IP) | An entity representing the DNS request client. |
224
-
|
225
217
226
218
Strong identifiers of a DNS entity:
227
219
- DomainName + DnsServerIp + HostIpAddress
@@ -239,7 +231,6 @@ Weak identifiers of a DNS entity:
239
231
| TryGetResourceGroup | Bool | The resource group value if it exists. |
240
232
| TryGetProvider | Bool | The provider value if it exists. |
241
233
| TryGetName | Bool | The name value if it exists. |
242
-
|
243
234
244
235
Strong identifiers of an Azure resource entity:
245
236
- ResourceId
@@ -253,7 +244,6 @@ Strong identifiers of an Azure resource entity:
253
244
| Type | String | 'filehash' |
254
245
| Algorithm | Enum | The hash algorithm type. Possible values:<li>Unknown<li>MD5<li>SHA1<li>SHA256<li>SHA256AC |
255
246
| Value | String | The hash value. |
256
-
|
257
247
258
248
Strong identifiers of a file hash entity:
259
249
- Algorithm + Value
@@ -267,7 +257,6 @@ Strong identifiers of a file hash entity:
267
257
| Type | String | ‘registry-key’ |
268
258
| Hive | Enum? | One of the following values:<li>HKEY_LOCAL_MACHINE<li>HKEY_CLASSES_ROOT<li>HKEY_CURRENT_CONFIG<li>HKEY_USERS<li>HKEY_CURRENT_USER_LOCAL_SETTINGS<li>HKEY_PERFORMANCE_DATA<li>HKEY_PERFORMANCE_NLSTEXT<li>HKEY_PERFORMANCE_TEXT<li>HKEY_A<li>HKEY_CURRENT_USER |
269
259
| Key | String | The registry key path. |
270
-
|
271
260
272
261
Strong identifiers of a registry key entity:
273
262
- Hive + Key
@@ -283,7 +272,6 @@ Strong identifiers of a registry key entity:
283
272
| Name | String | The registry value name. |
284
273
| Value | String | String-formatted representation of the value data. |
285
274
| ValueType | Enum? | One of the following values:<li>String<li>Binary<li>DWord<li>Qword<li>MultiString<li>ExpandString<li>None<li>Unknown<br>Values should conform to Microsoft.Win32.RegistryValueKind enumeration. |
286
-
|
287
275
288
276
Strong identifiers of a registry value entity:
289
277
- Key + Name
@@ -301,7 +289,6 @@ Weak identifiers of a registry value entity:
301
289
| DistinguishedName | String | The group distinguished name. |
302
290
| SID | String | The SID attribute is a single-value attribute that specifies the security identifier (SID) of the group. |
303
291
| ObjectGuid | Guid? | The objectGUID attribute is a single-value attribute that is the unique identifier for the object, assigned by Active Directory. |
304
-
|
305
292
306
293
Strong identifiers of a security group entity:
307
294
- DistinguishedName
@@ -314,7 +301,6 @@ Strong identifiers of a security group entity:
314
301
| ----- | ---- | ----------- |
315
302
| Type | String | 'url' |
316
303
| Url | Uri | A full URL the entity points to. |
317
-
|
318
304
319
305
Strong identifiers of a URL entity:
320
306
- Url (when an absolute URL)
@@ -343,7 +329,6 @@ Weak identifiers of a URL entity:
343
329
| MacAddress | String | The MAC address of the device. |
344
330
| Protocols | List<String>| A list of protocols that the device supports. |
345
331
| SerialNumber | String | The serial number of the device. |
346
-
|
347
332
348
333
Strong identifiers of an IoT device entity:
349
334
- IoTHub + DeviceId
@@ -361,7 +346,6 @@ Weak identifiers of an IoT device entity:
361
346
| Upn | String | The mailbox's UPN. |
362
347
| RiskLevel | Enum? | The risk level of this mailbox. Possible values:<li>None<li>Low<li>Medium<li>High |
363
348
| ExternalDirectoryObjectId | Guid? | The AzureAD identifier of mailbox. Similar to AadUserId in the Account entity, but this property is specific to mailbox object on the Office side. |
364
-
|
365
349
366
350
Strong identifiers of a mailbox entity:
367
351
- MailboxPrimaryAddress
@@ -391,7 +375,6 @@ Strong identifiers of a mailbox entity:
391
375
| ClusterQueryStartTime | DateTime? | Cluster start time - used as start time for cluster counts query. Usually dates to the End time minus DaysToLookBack setting from Microsoft Defender for Office 365 (see note above). |
392
376
| ClusterQueryEndTime | DateTime? | Cluster end time - used as end time for cluster counts query. Usually the mail data's received time. |
393
377
| ClusterGroup | String | Corresponds to the Kusto query key used on Microsoft Defender for Office 365 (see note above). |
394
-
|
395
378
396
379
Strong identifiers of a mail cluster entity:
397
380
- Query + Source
@@ -425,7 +408,6 @@ Strong identifiers of a mail cluster entity:
425
408
| DeliveryLocation | Enum? | The delivery location of this mail message. Possible values:<li>Unknown<li>Inbox<li>JunkFolder<li>DeletedFolder<li>Quarantine<li>External<li>Failed<li>Dropped<li>Forwarded |
426
409
| Language | String | The language in which the contents of the mail are written. |
427
410
| ThreatDetectionMethods | IList<String>| The list of Threat Detection Methods applied on this mail. |
428
-
|
429
411
430
412
Strong identifiers of a mail message entity:
431
413
- NetworkMessageId + Recipient
@@ -447,84 +429,88 @@ Strong identifiers of a mail message entity:
447
429
| SenderIp | String | The sender's IP. |
448
430
| Subject | String | The subject of submission mail. |
449
431
| ReportType | String | The submission type for the given instance. This maps to Junk, Phish, Malware or NotJunk. |
| Entities | String | A list of the entities identified in the alert. This list is the **entities** column from the SecurityAlert schema ([see documentation](security-alert-schema.md)). |
441
+
455
442
## Cloud application identifiers
456
443
457
444
The following list defines identifiers for known cloud applications. The App ID value is used as a [cloud application](#cloud-application) entity identifier.
0 commit comments