From 8451aead4f4179636498ba5eb6c79534bd000a4d Mon Sep 17 00:00:00 2001 From: Gowthamaraj rajendran Date: Tue, 24 Sep 2024 10:03:31 -0700 Subject: [PATCH] edit the data source example --- data_sources/windows_defender_alerts.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/data_sources/windows_defender_alerts.yml b/data_sources/windows_defender_alerts.yml index eae9475267..f0a30d0c78 100644 --- a/data_sources/windows_defender_alerts.yml +++ b/data_sources/windows_defender_alerts.yml @@ -54,7 +54,7 @@ fields: - AttackTechniques - DetectionSource - Severity -example_log: {"time": "2024-06-14T20:12:23.3360383Z", "tenantId": "abced-c7ee-abce-1123-123", "operationName": "Publish", +example_log: '{"time": "2024-06-14T20:12:23.3360383Z", "tenantId": "abced-c7ee-abce-1123-123", "operationName": "Publish", "category": "AdvancedHunting-AlertEvidence", "properties": {"Timestamp": "2024-04-14T19:59:59.1549925Z", "AlertId": "dc25", "EntityType": "CloudResource", "EvidenceRole": "Impacted", "SHA1": null, "SHA256": null, "RemoteIP": null, "LocalIP": null, "RemoteUrl": null, "AccountName": null, "AccountDomain": null, "AccountSid": null, "AccountObjectId": null, "DeviceId": null, @@ -64,4 +64,4 @@ example_log: {"time": "2024-06-14T20:12:23.3360383Z", "tenantId": "abced-c7ee-ab "Microsoft Defender for Cloud", "FileName": null, "FolderPath": null, "ProcessCommandLine": null, "EmailSubject": null, "ApplicationId": null, "Application": null, "DeviceName": null, "FileSize": null, "RegistryKey": null, "RegistryValueName": null, "RegistryValueData": null, "AccountUpn": null, "OAuthApplicationId": null, "Categories": "[\"InitialAccess\"]", "Title": "Suspicious authentication activity", "AttackTechniques": "", "DetectionSource": "DefenderForServers", - "Severity": "High"}, "Tenant": "DefaultTenant"} + "Severity": "High"}, "Tenant": "DefaultTenant"}'