RelevanceSystemAlerts_CL

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Tables Index

Attribute Value
Ingestion API Supported ✓ Yes

Contents

Schema (33 columns)

Source: KQL validation test schema

Column Name Type
_ResourceId string
aiSummary string
audit_createTime datetime
audit_creator string
audit_updater string
audit_updateTime datetime
detail_dataLeak_discoveryDocumentIds dynamic
detail_dataLeak_severity string
detail_detailType string
detail_initialAccessBroker_discoveryDocumentIds dynamic
detail_initialAccessBroker_severity string
detail_insiderThreat_discoveryDocumentIds dynamic
detail_insiderThreat_severity string
displayName string
etag string
findingCount string
findings dynamic
name string
priorityAnalysis_priorityLevel string
priorityAnalysis_reasoning string
relevanceAnalysis_confidence string
relevanceAnalysis_evidence_commonThemes dynamic
relevanceAnalysis_evidence_distinctThemes dynamic
relevanceAnalysis_reasoning string
relevanceAnalysis_relevanceLevel string
relevanceAnalysis_relevant bool
severityAnalysis_confidence string
severityAnalysis_reasoning string
severityAnalysis_severityLevel string
state string
TenantId string
TimeGenerated datetime
Type string

Schema References

Official Microsoft Learn documentation for field/column information:

Solutions (1)

This table is used by the following solutions:

Connectors (1)

This table is ingested by the following connectors:

Connector Selection Criteria
Google Threat Intelligence Relevance System Alerts

Content Items Using This Table (6)

Analytic Rules (6)

In solution Google Threat Intelligence:

Analytic Rule Selection Criteria
GTI - Data Leak Alert Detected
GTI - High Relevance Alert Detected
GTI - High and Critical Priority Alerts
GTI - Initial Access Broker Alert Detected
GTI - Insider Threat Alert Detected
GTI Relevance System Alert - Incident by Alert ID

Parsers Using This Table (2)

ASIM Parsers (1)

Parser Schema Product Selection Criteria
ASimAlertEventGoogleThreatIntelligence AlertEvent Google Threat Intelligence

Other Parsers (1)

Parser Solution Selection Criteria
GTIRelevanceSystemAlerts Google Threat Intelligence

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Tables Index