SIEM

Windows Defenter ATP - Cloud - BugFix

  • 1.  Windows Defenter ATP - Cloud - BugFix

    Posted Apr 07, 2020 07:28 AM
      |   view attached
    Hi,

    We have found that the native parser for ATP is not collecting every fields, so we share with you guys our version1.

    We are trying to get the IP address for correlation, the ATP gives the IP in the field: InternalIPv4List.

    "InternalIPv4List": "10.3.224.94;192.168.1.72;127.0.0.1",

    when the value  "IpAddress": "", is null, once we figer this raw data we post a version 2.

    Cheers,
    Hugo

    Attachment(s)

    xml
    MicrosoftATP-v1.xml   2K 1 version