Microsoft Sentinel
Incidents and responseNormalization Schema Alert
In brief
The documented supported value `Cryptominor` was corrected to `Cryptominer` in the alert normalization schema.
What Defender admins need to know
No administrator action is required; update any documentation references or validation logic that use the misspelled value.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
| ThreatName | Optional | string | The name of the threat or malware identified in the alert.
e.g. Init.exe |
| ThreatFirstReportedTime | Optional | datetime | Date and time when the threat was first reported.
e.g. 2024-09-19T10:12:10.0000000Z |
| ThreatLastReportedTime | Optional | datetime | Date and time when the threat was last reported.
e.g. 2024-09-19T10:12:10.0000000Z |
| ThreatCategory | Recommended | Enumerated | The category of the threat or malware identified in the alert.
Supported values are: Malware, Ransomware, Trojan, Virus, Worm, Adware, Spyware, Rootkit, CryptominorCryptominerPhishing, Spam, MaliciousUrl, Spoofing, Security Policy Violation, Unknown |
| ThreatOriginalCategory | Optional | string | The category of the threat as reported by the originating system. |
| ThreatIsActive | Optional | bool | Indicates whether the threat is currently active.
Supported values are: True, False |
| ThreatRiskLevel | Optional | RiskLevel (Integer) | The risk level associated with the threat. The level should be a number between 0 and 100.
Note: The value might be provided in the source record by using a different scale, which should be normalized to this scale. The original value should be stored in ThreatRiskLevelOriginal. |
@@ -131,7 +131,7 @@ The following table covers fields that provide critical insights into the rules | **ThreatName** | Optional | string | The name of the threat or malware identified in the alert.<br><br> e.g. `Init.exe` | | **ThreatFirstReportedTime** | Optional | datetime | Date and time when the threat was first reported.<br><br> e.g. `2024-09-19T10:12:10.0000000Z` | | **ThreatLastReportedTime** | Optional | datetime | Date and time when the threat was last reported.<br><br> e.g. `2024-09-19T10:12:10.0000000Z` |-| **ThreatCategory** | Recommended | Enumerated | The category of the threat or malware identified in the alert.<br><br>Supported values are: `Malware`, `Ransomware`, `Trojan`, `Virus`, `Worm`, `Adware`, `Spyware`, `Rootkit`, `Cryptominor`, `Phishing`, `Spam`, `MaliciousUrl`, `Spoofing`, `Security Policy Violation`, `Unknown` |+| **ThreatCategory** | Recommended | Enumerated | The category of the threat or malware identified in the alert.<br><br>Supported values are: `Malware`, `Ransomware`, `Trojan`, `Virus`, `Worm`, `Adware`, `Spyware`, `Rootkit`, `Cryptominer`, `Phishing`, `Spam`, `MaliciousUrl`, `Spoofing`, `Security Policy Violation`, `Unknown` | | **ThreatOriginalCategory** | Optional | string | The category of the threat as reported by the originating system. | | **ThreatIsActive** | Optional | bool | Indicates whether the threat is currently active.<br><br>Supported values are: `True`, `False` | | **ThreatRiskLevel** | Optional | RiskLevel (Integer) | The risk level associated with the threat. The level should be a number between 0 and 100.<br><br>Note: The value might be provided in the source record by using a different scale, which should be normalized to this scale. The original value should be stored in ThreatRiskLevelOriginal. |