Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
| Attribute | Value |
|---|---|
| Supports Transformations | ✗ No |
| Ingestion API Supported | ✓ Yes |
| Lake-Only Ingestion | ✗ No (source) |
Source: Connector definition
| Column Name | Type | Description |
|---|---|---|
| AssetType | string | Asset type for leaked-data events (asset.type, e.g. EMAIL/DOMAIN/IP/PHONE), domain-permutation and consumer-credential events (hardcoded to DOMAIN), or asset source kind for attack-surface events (source_type, e.g. WEB_APPLICATION/NETWORK_SERVICE/DNS). Empty for dark-web events whose target lives in type-specific fields inside Details. |
| AssetValue | string | Asset value: nested asset.value (leaked-data), original_domain (domain-permutation), or root-level asset_value (attack-surface, consumer-credential). Empty for dark-web events. |
| Details | dynamic | Full NordStellar event payload as received in the webhook envelope's event field. Contains every type-specific field (queryable as Details.<field> or Details['<field>']) and, for convenience and forward compatibility, also includes the source values for the promoted columns above. |
| EventId | string | Unique NordStellar event identifier (GUID). |
| EventTime | datetime | Original NordStellar event timestamp. Derived from event.detected_at when present, otherwise event.date_added, otherwise the envelope time field. May be significantly older than TimeGenerated when historical events are delivered. |
| EventType | string | NordStellar event type, e.g. DATA_BREACH, COMBO_LIST, MALWARE_INFECTION, CONSUMER_CREDENTIAL, DARK_WEB_FORUM_POST, DARK_WEB_TELEGRAM_POST, DARK_WEB_RANSOMWARE_POST, DARK_WEB_MARKETPLACE_POST, DOMAIN_PERMUTATION, ATTACK_SURFACE_WEB_APPLICATION_VULNERABILITY, ATTACK_SURFACE_NETWORK_SERVICE_VULNERABILITY, ATTACK_SURFACE_DNS_VULNERABILITY. |
| Module | string | NordStellar source module: LEAKED_DATA, DARK_WEB_MONITORING, DOMAIN_SQUATTING, or ATTACK_SURFACE. |
| RiskLevel | string | NordStellar risk level: CRITICAL, HIGH, MEDIUM, LOW, or INFORMATIONAL. |
| Tags | dynamic | Tags attached to the event. |
| TimeGenerated | datetime | Timestamp when the event was ingested into Microsoft Sentinel (set to ingestion time by the DCR transform). The original event timestamp is preserved in EventTime. |
Official Microsoft Learn documentation for field/column information:
This table is used by the following solutions:
This table is ingested by the following connectors:
| Connector | Selection Criteria |
|---|---|
| NordStellar (Push) |
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊