Skip to content

Microsoft Defender Identity

Microsoft Defender Identity


Microsoft Defender for Identity (formerly Azure Advanced Threat Protection, also known as Azure ATP) is a cloud-based security solution that leverages your on-premises Active Directory signals to identify, detect, and investigate advanced threats, compromised identities, and malicious insider actions directed at your organization.

Product Details

Vendor URL: Microsoft Defender Identity

Product Type: Identity

Product Tier: Tier II

Integration Method: Syslog

Integration URL: Configure Windows Event collection

Log Guide: Siem log refernce

Parser Details

Log Format: CEF

Expected Normalization Rate: near 100%


UDM Fields (list of all UDM fields leveraged in the Parser):

Log File Field UDM Field
App principal.application
CEF description metadata.description
CEF version metadata.product_version
cs1 security_result.url_back_to_product
cs3 metadata.url_back_to_product
Event Type metadata.product_event_type
externalId metadata.product_log_id
msg security_result.description
Observer Observer.hostname
Product metadata.product_name
Severity security_result.severity
shost principal.hostname
shostfqdn principal.asset.hostname
suser principal.user.userid
Vendor metadata.vendor_name

Log Sample

{<36>1 2022-11-22T22:08:22.221058+00:00 Hostname1 CEF 10912 RemoteExecutionSecurityAlert 0|Microsoft|Azure ATP|2.194.15869.60621|RemoteExecutionSecurityAlert|Remote code execution attempt|5|start=2022-11-22T22:05:10.8398810Z app=Wmi shost=Hostname2 msg=User1 made an attempt to run commands remotely on Hostname2 from Hostname3, using 1 WMI method.  externalId=2019 cs1Label=url cs2Label=trigger cs2=new cs3Label=mSecUrl cs3= }

Sample Parsing

metadata.event_timestamp = "2022-11-22T22:08:22"
metadata.event_type = "GENERIC_EVENT"
metadata.vendor_name = "Microsoft"
metadata.product_name = "Azure ATP"
metadata.product_event_type = "application_request"
metadata.product_version = "2.194.15869.60621"
metadata.product_event_type = "RemoteExecutionSecurityAlert"
metadata.description = "Remote code execution attempt"
metadata.url_back_to_product = ""
principal.hostname = "Hostname2"
principal.application = "Wmi"
observer.hostname = "Hostname1"
security_result.description = "User1 made an attempt to run commands remotely on Hostname2 from Hostname3, using 1 WMI method."
security_result.url_back_to_product = ""
security_result.severity = MEDIUM

Parser Alerting

This product currently does not have any Parser-based Alerting


Coming Soon