Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
| Attribute | Value |
|---|---|
| Type | Workbook |
| Solution | Microsoft Defender XDR |
| Source | View on GitHub |
This content item queries data from the following tables:
| Table | Selection Criteria | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|---|
AlertEvidence |
ActionType in "AdminSubmissionSubmitted,AttackSimUserSubmission,ClickBlocked,Malware ZAP,Phish ZAP,Spam ZAP,UserSubmission"ActionType == "Automated Remediation"ActionType contains "Submission"ActionType contains "UserSubmission"ActionType contains "ZAP"ActionType has "Malware ZAP"ActionType has "Phish ZAP"ActionType has "Spam ZAP"ActionType has "ZAP"ActionType has_any "ClickAllowed"ActionType has_any "ClickBlocked"ActionType has_any "UrlErrorPage"ActionType has_any "UrlScanInProgress" |
✓ | ✗ | ✓ |
CloudAppEvents |
ActionType in "AdminSubmissionSubmitted,AttackSimUserSubmission,FileMalwareDetected,Malware ZAP,Phish ZAP,Redelivery,Spam ZAP,SubmissionNotification,UserSubmission"ActionType contains "AdminSubmission"ActionType contains "AdminSubmissionTriage"ActionType contains "Submission"ActionType contains "UserSubmission"ActionType contains "UserSubmissionTriage"UserAgent == "MS Scanner ATP" |
✓ | ✗ | ✓ |
EmailEvents |
ActionType == "UserSubmission"DeliveryAction == "Delivered"DeliveryAction != "Delivered"OrgLevelAction in "Allow,Block"OrgLevelPolicy != "Phishing simulation"OrgLevelPolicy != "SecOps Mailbox"UserLevelAction in "Allow,Block" |
✓ | ✗ | ✓ |
EmailPostDeliveryEvents |
Action == "Quarantine release"ActionResult == "Success" |
✓ | ✗ | ? |
EmailUrlInfo |
✓ | ✗ | ? | |
SecurityAlert |
✓ | ✗ | ✓ | |
SecurityIncident |
Classification == "TruePositive" |
✓ | ✗ | ✓ |
UrlClickEvents |
✓ | ✗ | ? |
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊